Faq Builder Ays
Monthly
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
A Cross-Site Scripting (XSS) vulnerability exists in AYS Pro FAQ Builder plugin versions up to and including 1.8.2, allowing attackers to inject malicious scripts through improperly neutralized input during web page generation. The vulnerability stems from incorrectly configured access control security levels, enabling unauthenticated or low-privileged attackers to execute arbitrary JavaScript in the context of affected WordPress sites. While CVSS and EPSS scores are not publicly available, the vulnerability was reported by Patchstack and assigned ENISA EUVD ID EUVD-2026-15661, indicating formal recognition across European vulnerability databases.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
A Cross-Site Scripting (XSS) vulnerability exists in AYS Pro FAQ Builder plugin versions up to and including 1.8.2, allowing attackers to inject malicious scripts through improperly neutralized input during web page generation. The vulnerability stems from incorrectly configured access control security levels, enabling unauthenticated or low-privileged attackers to execute arbitrary JavaScript in the context of affected WordPress sites. While CVSS and EPSS scores are not publicly available, the vulnerability was reported by Patchstack and assigned ENISA EUVD ID EUVD-2026-15661, indicating formal recognition across European vulnerability databases.