CVE-2026-85593

phpMyFAQ versions before 4.1.8 are affected by a stored XSS vulnerability in FaqHelper::convertOldInternalLinks(). The root cause is a call to html_entity_decode() on already-sanitized FAQ content, which reverses the entity-encoding protection that was applied during sanitization. Any authenticat...