CVE-2026-46367 is a stored cross-site scripting vulnerability in phpMyFAQ before version 4.1.2, specifically in the Utils::parseUrl() function. The flaw allows authenticated users to inject JavaScript code via malformed URLs embedded in comments. The injected script can execute in the context of other users viewing the FAQ pages, enabling theft of admin session cookies and full application compromise. The vulnerability requires user interaction (viewing the affected page) and authenticated user privileges to inject the payload. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality impact with limited integrity impact.

Successful exploitation allows an authenticated user to inject malicious JavaScript that executes in the browsers of other users viewing the affected FAQ pages. This can lead to theft of administrative session cookies and full application takeover. The vulnerability compromises confidentiality and integrity of the application data and sessions. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict comment submission privileges to trusted users only and consider sanitizing or filtering URLs in comments to prevent injection of unescaped quotes or event handlers. Monitor phpMyFAQ vendor channels for updates and apply patches promptly once released.