The vulnerability allows unauthenticated users to submit arbitrary content through the ays_get_user_information endpoint of the FAQ Builder AYS WordPress plugin. Because the plugin fails to sanitize or escape the submitted data before storing it and the escaping performed is later neutralized by a decoding step, the stored payload is rendered as executable script within the admin area. This enables an attacker to run arbitrary JavaScript with the privileges of a logged‑in administrator, potentially leading to credential theft, defacement, or further lateral movement.

Any installation of the FAQ Builder AYS WordPress plugin at versions 1.6.3 through 1.8.4 is vulnerable. The issue is present only in those releases before 1.8.5, where the input handling in ays_get_user_information lacks proper sanitization.

The lack of authentication on the input endpoint means the attack can be performed publicly. No exploit probability score is provided and the vulnerability is not listed in CISA's KEV catalog. However, because the malicious code will execute in the context of an administrator session, the potential impact is high. The attacker needs only to forge a payload that reaches the endpoint, which can be done via crafted GET or POST requests. If an admin later logs in, the payload runs with their privileges.