phpMyFAQ versions prior to 4.1.2 contain a stored cross‑site scripting flaw in the search.twig template, where result.question and result.answerPreview are rendered with the raw filter. This bypasses the auto‑escape mechanism and allows an attacker with FAQ editor privileges to inject HTML‑entity‑encoded payloads that are not properly sanitized, enabling execution of arbitrary JavaScript in the browsers of every visitor to the site, including administrators, potentially leading to session hijacking or data exfiltration.

The affected product is phpMyFAQ, supplied by the vendor thorsten. All releases before version 4.1.2 are vulnerable; upgrading to 4.1.2 or later removes the raw filter usage that permits the injection.

The flaw carries a CVSS score of 6.9, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is through the web interface’s search feature, where an authorized editor can submit malicious content that is subsequently stored and rendered for all users. Because the vulnerability executes client‑side code, any user visiting a search result page could be impacted, making it a significant risk for sites with sensitive information.