This vulnerability is a stored cross‑site scripting flaw in the function that converts legacy internal links in FAQ content. By calling html_entity_decode on already sanitized data, the protection is reversed, allowing an attacker who can edit a FAQ to inject arbitrary JavaScript. The injected script runs in the browsers of every visitor to the affected FAQ page, which can lead to session hijacking, data theft, or defacement.

The flaw affects the phpMyFAQ application delivered by the vendor thorsten. Any installation of phpMyFAQ older than version 4.1.8 is susceptible, regardless of other configuration. Administrators should verify that their deployment uses a safe version or apply the appropriate fix.

The CVSS base score is 5.1, placing the issue in the medium severity range. EPSS data are not available and the issue is not listed in the CISA KEV catalog, which suggests a lower exploitation probability overall. Attackers need authenticated edit privileges to inject the payload; thus the vulnerability cannot be exploited by unauthenticated users over the network, but once a user with sufficient rights has created malicious content, all other users who view the page are impacted.