The vulnerability allows authenticated content authors to embed malicious iframes that reference data:text/html sources in FAQ or News content. These iframes bypass the hostless media‑host allowlist and are rendered via Twig's raw filter. Because the payload is stored, any visitor who views the affected content will execute the injected JavaScript, allowing attackers to deliver phishing pages or perform top‑frame redirects that undermine user trust. This stored cross‑site scripting flaw is classified as CWE‑79.

Affected products are phpMyFAQ versions 3.2.1 through 4.1.9 and 4.2.0‑alpha through 4.2.0‑beta. Users must be authenticated as content authors to inject code. The vulnerability is present in these releases and has been fixed starting with 4.1.9 and 4.2.0‑beta.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is unavailable, so exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation. Attackers would need sufficient privileges to create or edit FAQ or News content to embed the malicious iframe; once embedded, the attack would affect all site visitors until the content is removed or sanitized.