A malformed e‑mail address containing raw HTML, such as "<script>alert(1)</script>"@evil.com, is accepted by the PHP FILTER_VALIDATE_EMAIL function in phpMyFAQ versions older than 4.1.1. The email is persisted without sanitization and later rendered in the administrative FAQ editor template using Twig’s |raw filter, which bypasses the framework’s auto‑escaping. When an administrator opens the editor, the e‑mail address is injected into the page’s HTML, allowing arbitrary JavaScript to execute in the context of any admin user who views the page. This can lead to session hijacking, theft of administrative credentials, or defacement of the internal interface.

The vulnerability exists in all phpMyFAQ releases prior to version 4.1.1. Administrators running older versions should verify whether the guest FAQ submission feature is enabled, as it is the entry point for the malicious e‑mail address.

The CVSS base score of 5.4 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The issue is not listed in CISA's KEV catalog. The likely attack vector is a web submission of a malicious e‑mail address by an unauthenticated attacker—this inference is based on the description of how the email is accepted and stored.