Medium severity5.4NVD Advisory· Published May 15, 2026· Updated May 28, 2026

CVE-2026-46363

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
phpmyfaq/phpmyfaqPackagist	< 4.1.2	4.1.2
thorsten/phpmyfaqPackagist	< 4.1.2	4.1.2

Affected products

Thorsten/Phpmyfaqllm-fuzzy
Range: <4.1.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-f5p7-2c9q-8896ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-46363ghsaADVISORY
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896nvdWEB
www.vulncheck.com/advisories/phpmyfaq-stored-xss-in-faq-question-answer-via-encode-decode-bypassnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000