An unauthenticated attacker can submit an email address containing raw HTML into the guest FAQ form. PHP’s FILTER_VALIDATE_EMAIL accepts the string, and the application stores it without escaping. Later, the value is rendered in the admin FAQ editor template using Twig’s raw filter, bypassing all escaping. When an administrator opens the FAQ, the injected code runs in their browser, which can lead to credential theft, session hijacking, or page defacement.

The issue affects phpMyFAQ version 4.1.0 and earlier. Thorsten’s phpMyFAQ project releases a fix in version 4.1.1, which removes the unsanitized email field usage. Only installations that use the guest FAQ feature and have not applied the 4.1.1 patch are vulnerable.

The CVSS score of 5.4 indicates a medium severity. An EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply submitting a crafted email address via the public forum; execution occurs only when an administrator later views the FAQ, so the impact is limited to admin users but could result in full compromise of the administration session if the injected code is malicious.