CVE-2026-81737: CWE-79 Cross-Site Scripting (XSS) in FAQ Builder AYS

CVE-2026-81737 is a stored cross-site scripting vulnerability in the FAQ Builder AYS WordPress plugin before version 1.8.5. The flaw arises from improper sanitization and escaping of user-submitted content by unauthenticated visitors, which is stored and later rendered in an administrative interface. The escaping mechanisms are undone by a subsequent decoding step, enabling execution of arbitrary scripts within the administrator's browser context. This vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a logged-in administrator's browser. This can lead to full compromise of the administrative interface, including theft of credentials, session hijacking, and potentially complete site takeover.

No official fix or patch is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a patch is available, restrict access to the administrative interface and consider disabling or removing the FAQ Builder AYS plugin if possible to reduce exposure.