CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Unauthenticated users can inject JavaScript via HTML entity bypass in FAQ submissions, leading to admin account takeover when administrators view the content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-56736?
CVE-2026-56736 is a high-severity cross-site scripting vulnerability in thorsten phpMyFAQ, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because `html_entity_decode()` converts HTML entities into executable HTML after `strip_tags()` has already passed them through, and the admin template renders the content with Twig's `|raw` filter without any output sanitization. Version 4.2.0-alpha fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-56736?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | All versions | 4.2.0-alpha |
thorsten/phpmyfaq Packagist | All versions | 4.2.0-alpha |
phpmyfaq/phpmyfaq Packagist | All versions | 4.2.0-alpha |
phpmyfaq/phpmyfaq Packagist | All versions | 4.2.0-alpha |
How do I fix CVE-2026-56736?
Upgrade thorsten/phpmyfaq to 4.2.0-alpha or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-56736 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56736 exists.
Sources
Also known as GHSA-pgwp-vc7q-cvj3.