The CM FAQ plugin for WordPress is vulnerable to reflected cross‑site scripting because it uses remove_query_arg without escaping the URL query on all pages that include user input. An attacker can inject arbitrary JavaScript that will execute in the browser of any user who is tricked into clicking a crafted link or visiting a malicious URL. This flaw can be exploited by unauthenticated users and can result in session hijacking, credential theft, defacement, or the deployment of malware on the victim’s machine.

The vulnerability affects the CM FAQ – Simplify support with an intuitive FAQ management tool plugin developed by creativemindssolutions. All released versions up to and including 1.2.5 are impacted; version 1.2.6 and later contain the fix.

With a CVSS score of 6.1 and an EPSS score below 1%, the exploitation likelihood is low but non‑zero. The flaw is not listed in the CISA KEV catalog, indicating that no publicly reported exploits are currently tracked. Attackers would need only an unauthenticated link and a victim’s browser to deliver the payload, making the vulnerability exploitable without authentication.