A stored cross‑site scripting vulnerability allows any unauthenticated or low‑privileged registered user to submit FAQ content containing HTML entities that are later interpreted as executable JavaScript. The application strips tags, then decodes entities, and finally renders the stored content with Twig's raw filter, enabling the injected script to run in an administrator's browser. This can lead to session hijacking, credential theft, and full takeover of the admin account. The flaw is a classic input‑validation weakness (CWE‑79).

The open‑source phpMyFAQ application from thorsten is affected. All releases older than version 4.2.0‑alpha contain the vulnerability, as they process and store FAQ content without proper sanitization before rendering it in the admin interface.

The vulnerability receives a CVSS score of 8.2, indicating high severity. The EPSS score is less than 1%, suggesting a low exploitation probability, though the lack of authentication on the submission endpoint means an attacker can easily trigger the flaw. It is not listed in the CISA KEV catalog, so no current evidence of exploitation has been reported.