---
id: CVE-2026-46367
title: 'phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering'
summary: >-
  phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in
  Utils::parseUrl() that allows authenticated users to inject JavaScript via
  malformed URLs in comments. Attackers can craft URLs with unescaped quotes to
  inject…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: thorsten
product: phpmyfaq
affected:
  - phpmyfaq >= 4.1.1 < 4.1.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-16T01:18:54.462603Z'
exploitAvailable: true
published: '2026-05-15'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:58.636Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46367'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9525-27vj-c8r8
    label: GitHub Security Advisory (GHSA-9525-27vj-c8r8)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-stored-xss-via-utils-parseurl-in-comment-rendering
    label: >-
      VulnCheck Advisory: phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment
      Rendering
tags:
  - cve.org
  - exploit-available
epss: 0.00249
epssPercentile: 0.16347
ingestedAt: '2026-11-08T14:51:22.417Z'
---

## Overview

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.

## Affected

- `phpmyfaq >= 4.1.1 < 4.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.