The vulnerability in phpMyFAQ prior to version 4.1.2 is a stored cross-site scripting issue located in the search.twig template. Specifically, the fields result.question and result.answerPreview are rendered with the raw filter, disabling the framework's autoescape protection. Attackers who have FAQ editor privileges can inject malicious HTML-entity-encoded payloads that bypass the html_entity_decode(strip_tags()) sanitization in SearchController.php. This allows execution of arbitrary JavaScript in the context of every visitor's browser, including administrators, potentially compromising session integrity or enabling further attacks. The CVSS 3.1 score is 6.9 (medium severity), with network attack vector, low attack complexity, high privileges required, and user interaction needed. No patch or official fix has been documented yet.

Successful exploitation allows an attacker with FAQ editor privileges to execute arbitrary JavaScript code in the browsers of users viewing the affected FAQ search results, including administrators. This can lead to session hijacking, unauthorized actions performed in the context of the victim, or other client-side impacts. The vulnerability does not affect availability and requires high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict FAQ editor privileges to trusted users only and consider monitoring for suspicious activity related to injected scripts. Avoid exposing the vulnerable search functionality to untrusted users. Do not rely solely on html_entity_decode(strip_tags()) sanitization as it can be bypassed in this context.