CVE-2026-25346: XSS in FAQ Builder AYS WordPress Plugin

Successful exploitation of CVE-2026-25346 enables an attacker to execute arbitrary JavaScript code within the context of a victim's browser. This can lead to a variety of malicious outcomes, including session hijacking, credential theft (e.g., stealing login cookies), defacement of the website, and redirection to phishing sites. The impact is particularly severe because XSS vulnerabilities often target authenticated users, granting attackers access to sensitive data and administrative functionalities. The attacker could potentially gain control of the entire WordPress site if they can exploit this vulnerability to escalate privileges.

1. Reserved2026-02-02
2. Published2026-03-25
3. Modified2026-04-29
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-25346 is to immediately upgrade the FAQ Builder AYS plugin to version 1.8.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include strict input validation and output encoding on user-supplied data within the plugin's templates. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide a layer of protection. After upgrading, verify the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the plugin's input fields and confirming that it is properly sanitized.

Active installs

100Known

Plugin rating

5.0

Requires WordPress

4.0+

Compatible up to

7.0