A regular expression bypass in the function that removes attributes allows malicious code to be saved in FAQ entries. When a user views such an entry, the inserted code runs in that user’s browser, giving an attacker the possibility to steal session data, deface the interface, or perform other client‑side attacks associated with CWE‑79.

All phpMyFAQ instances supplied by thorsten older than version 4.1.1 are vulnerable. The issue was fixed in the 4.1.1 release, so installations running that version or newer are no longer affected.

The CVSS score of 6.1 classifies this as medium severity. The EPSS score is not provided, and the flaw is not listed in the CISA KEV catalog. Exploitation requires write access to FAQ entries, typically through administrative credentials. If public or unauthenticated content submission is allowed, the risk increases. The attack vector is client‑side, relying on stored malicious content that browsers will execute.