phpMyFAQ Stored XSS: Authenticated Users Can Steal Admin Sessions

The National Vulnerability Database reports a critical stored cross-site scripting (XSS) vulnerability, CVE-2026-46367, in phpMyFAQ versions prior to 4.1.2. This flaw resides in the Utils::parseUrl() function, allowing authenticated users to inject malicious JavaScript through malformed URLs within comments. The attacker’s calculus here is straightforward: craft a URL with unescaped quotes, embed an event handler, and wait for an administrator to view an affected FAQ page.

Once triggered, this XSS attack facilitates the theft of admin session cookies, potentially leading to a full application takeover. The CVSS score of 7.6 (HIGH) reflects the significant impact, particularly the high confidentiality impact and the ability to compromise the system with only low privileges and user interaction. It’s a classic client-side attack with server-side persistence through stored XSS.

For defenders, this means a compromised user account can escalate privileges dramatically. Attackers aren’t just defacing pages; they’re aiming for persistent access and control. This isn’t theoretical; it’s a well-understood attack vector that has proven effective time and again for gaining persistence and lateral movement within web applications. Patching is paramount, but so is understanding the broader implications of user-generated content and inadequate input sanitization.