CVE-2026-85593 — phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ conte…
Published: 2026-09-04 · CVSS: 5.1 · CVSS 4.0
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7