CVE-2026-111894: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in thorsten phpMyFAQ

The vulnerability in phpMyFAQ affects versions >=3.2.1 <4.1.9 and >=4.2.0-alpha <4.2.0-beta. It is a stored cross-site scripting issue where authenticated content authors can embed iframes with data:text/html sources in FAQ or News content. The vulnerability arises because the FaqHelper::cleanUpContent() function's allowlist can be bypassed, and the content is rendered using Twig's raw filter without proper neutralization. This allows malicious scripts to execute in the context of users viewing the content, enabling phishing interfaces or top-frame redirects.

An attacker with authenticated content author privileges can inject malicious JavaScript that executes in the browsers of users viewing the affected FAQ or News content. This can lead to phishing attacks or unwanted redirects, potentially compromising user trust and security. The CVSS 4.0 score is 5.1 (medium severity), reflecting the need for authentication and partial user interaction for exploitation.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict content author privileges to trusted users and consider disabling or limiting the use of raw HTML content embedding in FAQs or News items.