Description

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T06:17:19.667Z",
  "pubdate": "2026-09-02T06:17:19.667Z",
  "executiveSummary": "The FAQ Builder AYS WordPress plugin prior to version 1.8.5 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from the improper handling of user-supplied data submitted by unauthenticated visitors.\nThe vulnerability allows an attacker to inject malicious JavaScript payloads into the plugin's data storage. This content is subsequently rendered within the WordPress administrative interface without adequate sanitization or output escaping.\nThe primary risk associated with this vulnerability is the compromise of an administrator's session. When a logged-in administrator views the compromised FAQ data, the malicious script executes within their browser context, potentially leading to unauthorized administrative actions, account takeover, or configuration changes.\nBecause the input is processed from unauthenticated sources, the attack vector is publicly accessible and requires no prior authentication to initiate. The impact is significant due to the privilege escalation implicit in executing arbitrary code within the context of an active administrative session.",
  "technicalDetails": "The root cause of this Stored XSS vulnerability is a dual failure in the input/output lifecycle of user-submitted data. First, the FAQ Builder AYS plugin fails to implement sufficient sanitization or input validation on data received from unauthenticated visitors before persisting that data to the WordPress database. Second, the plugin's output handling mechanism is fundamentally flawed; while some initial escaping may be applied to the stored content, a subsequent decoding step effectively neutralizes these security controls, re-introducing malicious characters to the output stream.\nThe attack flow begins when an unauthenticated attacker submits a crafted payload, typically consisting of JavaScript, through a form handled by the FAQ Builder AYS plugin. Since the plugin does not enforce strict character filtering or context-aware output encoding, this payload is stored as valid FAQ content.\nThe execution phase occurs when a site administrator navigates to the administrative dashboard page where the FAQ entries are managed or displayed. Upon loading the page, the application retrieves the malicious entry from the database and renders it in the browser. Because the plugin performs a decoding operation that reverses existing protections, the browser treats the stored payload as legitimate code, resulting in the execution of the attacker's script under the administrator's security context.\nAffected versions are strictly identified as those prior to 1.8.5. The vulnerability resides in the data processing and administrative display components of the plugin. The attack requires no authentication, allowing any remote visitor to populate the database with persistent malicious scripts. The post-exploitation impact is severe, as the attacker can perform actions that the administrator is authorized to perform, such as installing malicious plugins, creating new administrative accounts, or exfiltrating sensitive site information. The browser-side execution bypasses standard backend access controls, relying instead on the trust established between the administrator's session cookie and the WordPress dashboard."
}