Cross-site scripting in phpMyFAQ - CVE-2026-46367
Published: May 5, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU130125
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-46367
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to cross-site scripting in Utils::parseUrl() and comment rendering when rendering stored comment content containing a crafted URL. A remote user can submit a specially crafted comment to execute arbitrary script in a victim's browser.
Only instances with main.enableCommentEditor enabled are vulnerable. User interaction is required to view the affected FAQ or News page or the admin comment panel.
Affected software
phpMyFAQ
How to mitigate CVE-2026-46367
Install security update from vendor's website.
phpMyFAQ - update to 4.1.2