CVE-2026-25346 describes a cross-site scripting vulnerability in Ays Pro FAQ Builder AYS (versions up to 1.8.2) caused by improper input neutralization during web page generation and misconfigured access control security levels. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is provided in the data, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to unauthorized disclosure of information, modification of data, or disruption of service. The vulnerability requires user interaction and can be exploited remotely without privileges, making it a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and applying any available workarounds recommended by the vendor. Monitor official channels for updates regarding patches or mitigations.