CVE-2026-56736
Deferred Deferred - Pending Action

Stored XSS in phpMyFAQ Prior to 4.2.0-alpha

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because `html_entity_decode()` converts HTML entities into executable HTML after `strip_tags()` has already passed them through, and the admin template renders the content with Twig's `|raw` filter without any output sanitization. Version 4.2.0-alpha fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-56736
EUVD
EUVD-2026-86010

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.2.0-alpha (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in phpMyFAQ versions before 4.2.0-alpha. It allows unauthenticated or low-privileged users to inject malicious JavaScript into FAQ entries. When an administrator reviews or edits these entries, the payload executes in their browser, potentially leading to account takeover via session theft.

Detection Guidance

To detect this vulnerability, inspect phpMyFAQ FAQ entries for suspicious JavaScript payloads in the admin review interface. Check if the WYSIWYG editor is enabled for frontend submissions and if guest submissions are allowed. Review server logs for unusual FAQ submission patterns or payloads containing script tags or event handlers.

Impact Analysis

An attacker could take over an administrator's account by injecting malicious JavaScript into a FAQ entry. This could lead to unauthorized access to sensitive data, manipulation of FAQ content, or further compromise of the phpMyFAQ system. The attack requires enabling the WYSIWYG editor for frontend submissions and allowing guest submissions, which are default settings.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. A successful exploit may result in data breaches, unauthorized modifications, or disclosure of protected health information, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.2.0-alpha or later immediately. Disable the WYSIWYG editor for frontend FAQ submissions and restrict guest FAQ submissions to trusted users only. Review existing FAQ entries for malicious content and remove any suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart