WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability

Successful exploitation of CVE-2026-25346 enables an attacker to execute arbitrary JavaScript code within the context of a victim's browser. This can lead to a variety of malicious outcomes, including session hijacking, credential theft (e.g., stealing login cookies), defacement of the website, and redirection to phishing sites. The impact is particularly severe because XSS vulnerabilities often target authenticated users, granting attackers access to sensitive data and administrative functionalities. The attacker could potentially gain control of the entire WordPress site if they can exploit this vulnerability to escalate privileges.

Websites utilizing the FAQ Builder AYS plugin, particularly those with user-generated content or forms, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the exploitation of this vulnerability on other sites using the plugin.

• wordpress / composer / npm:

grep -r '<script>alert('XSS')</script>' /var/www/html/wp-content/plugins/faq-builder-ays/

• wordpress / composer / npm:

wp plugin list --status=active | grep faq-builder-ays

• wordpress / composer / npm:

wp plugin update faq-builder-ays --all

1. 2026-03-25Disclosure

   disclosure

1. 已保留2026-02-02
2. 发布日期2026-03-25
3. 修改日期2026-04-29
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2026-25346 is to immediately upgrade the FAQ Builder AYS plugin to version 1.8.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include strict input validation and output encoding on user-supplied data within the plugin's templates. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide a layer of protection. After upgrading, verify the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the plugin's input fields and confirming that it is properly sanitized.

活跃安装数

100已知

插件评分

5.0

需要WordPress版本

4.0+

兼容至

7.0