VULNERABILITY INTELLIGENCE
CVE-2026-85593
CVSS score5.4 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.
Weakness classification
- disclosure@vulncheck.com: CWE-79