CVE-2026-46361 is a stored cross-site scripting vulnerability in phpMyFAQ before version 4.1.2. The issue occurs in the search.twig template where certain fields are rendered with the raw filter, disabling autoescape and allowing injection of malicious scripts. Attackers who have FAQ editor privileges can inject HTML-entity-encoded payloads that evade the sanitization performed by html_entity_decode(strip_tags()) in SearchController.php. This results in execution of arbitrary JavaScript in the context of any user viewing the affected FAQ pages, including administrators. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.9 (Network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, no availability impact). No official patch or remediation guidance is currently provided.

Successful exploitation allows an attacker with FAQ editor privileges to execute arbitrary JavaScript in the browsers of users who view the affected FAQ content, including administrators. This can lead to compromise of user sessions, theft of sensitive information, or other actions possible via script execution in the victim's browser. The vulnerability affects confidentiality primarily, with no direct impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict FAQ editor privileges to trusted users only to reduce risk. Monitor for updates from the vendor regarding patches or official mitigations. Avoid exposing the vulnerable phpMyFAQ versions to untrusted users with editing capabilities.