CVE-2026-85593

5.1 mediumEPSS 0.2%

Medium (5.1). EPSS 0.2% chance of exploitation in the next 30 days.

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-04
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-x6qj-5jhf-xgpm
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-stored-xss-via-html-entity-decode

Check your stack JSON