CVE-2026-46367 is a stored cross-site scripting vulnerability in phpMyFAQ before version 4.1.2. It arises from improper neutralization of input in the Utils::parseUrl() function, allowing authenticated users to inject JavaScript code via malformed URLs embedded in comments. This malicious script executes when other users view the affected FAQ pages, enabling theft of admin session cookies and potential full application compromise. The vulnerability has a CVSS 3.1 score of 7.6, indicating high severity. No official patch or remediation level has been published yet, and the product is not a cloud service.

Successful exploitation allows an authenticated user to inject persistent malicious JavaScript into FAQ comments, which executes in the context of other users' browsers, including administrators. This can lead to theft of admin session cookies and full application takeover. The vulnerability compromises confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict comment submission privileges to trusted users only and consider sanitizing or filtering URLs in comments to prevent injection of unescaped quotes or event handlers. Monitor phpMyFAQ vendor communications for updates on patches or official mitigations.