Security Advisory
CVE-2026-85593
5.4
MEDIUM
Vulnerability Description
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.
Published Date
September 4, 2026
Official Source
NIST NVD Advisory