phpMyFAQ versions prior to 4.1.2 contain a stored cross‑site scripting flaw in the Utils::parseUrl() routine used when rendering comments. Attackers who are authenticated can submit comments that include specially crafted URLs with unescaped quotes. When visitors load the affected FAQ page, the embedded JavaScript executes in the victims’ browsers, allowing cookie theft and ultimately full control of the application.

The vulnerability affects the phpMyFAQ application provided by the vendor thorsten. Any deployment using a version older than 4.1.2 is susceptible; the vulnerability is tied to the comment rendering feature that processes URLs via the Utils::parseUrl() function.

The flaw has a CVSS score of 7.6, indicating medium‑to‑high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. Exploitation requires an authenticated user with permission to post comments, which can then be viewed by any visitor, providing a straightforward attack path to inject malicious code into the application’s output. Once the code runs, attackers can steal session cookies and gain complete control of the phpMyFAQ installation.