CVE-2026-85593CWE-79cross-site-scripting

CVE-2026-85593

Medium · published September 4, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
13.6
In the wild
Unconfirmed
What it is

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00235 · 13.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-04T16:17Z
References (2)
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-x6qj-5jhf-xgpm · [email protected]https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-stored-xss-via-html-entity-decode · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:29Z
    phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
    cvelistv5