CVE-2026-25346
Cross-site Scripting in FAQ Builder AYS Allows Access Bypass
Publication date: 2026-03-25
Last updated on: 2026-03-25
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ays | faq_builder_ays | to 1.8.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25346 is a Cross Site Scripting (XSS) vulnerability affecting the WordPress FAQ Builder AYS Plugin versions up to and including 1.8.2.
This vulnerability allows attackers to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into websites using the plugin. These scripts execute when visitors access the compromised site.
Exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form, although no authentication is required to initiate the attack.
The vulnerability is classified under OWASP Top 10 category A3: Injection and has a CVSS score of 7.1, indicating moderate severity.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject and execute malicious scripts on your website.
- Injected scripts can perform unwanted redirects, display unauthorized advertisements, or execute other harmful HTML payloads.
- Visitors to your site may be exposed to these malicious actions, potentially harming user trust and site reputation.
Although the CVSS score is moderate, the issue is considered low priority with low impact and is unlikely to be widely exploited.
Updating the plugin to version 1.8.3 or later mitigates this risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2026-25346 is a Cross Site Scripting (XSS) vulnerability in the WordPress FAQ Builder AYS Plugin up to version 1.8.2. Detection typically involves identifying attempts to inject malicious scripts via crafted URLs, forms, or pages targeting the plugin.
While no specific commands are provided, common detection methods include monitoring web server logs for suspicious input patterns or payloads, using web application scanners that detect XSS vulnerabilities, and inspecting HTTP requests for script injections targeting the FAQ Builder AYS plugin.
For example, you might use tools like curl or wget to test input fields or URLs for script injection, or employ security scanners such as OWASP ZAP or Burp Suite to identify XSS vulnerabilities in the plugin.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate mitigation step is to update the FAQ Builder AYS Plugin to version 1.8.3 or later, where the vulnerability is patched.
Additionally, users are advised to enable auto-updates if available, to ensure the plugin remains up to date with security patches.
Until the update is applied, restricting access to the plugin or disabling it temporarily can reduce risk, especially since exploitation requires user interaction but no authentication.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-25346 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.