CVE-2026-81737

FAQ Builder AYS, a WordPress FAQ plugin, does not sanitize or escape FAQ content submitted by unauthenticated visitors, and the escaping it does apply is undone by a later decoding step, resulting in stored cross-site scripting (CWE-79). An attacker triggers it by submitting crafted question or answer content through the plugin's front-end FAQ submission functionality; the malicious markup is stored and later rendered on an admin-area page. When a logged-in administrator views that page, the attacker's script executes in the admin's session, allowing actions such as creating new admin accounts, changing site settings, or exfiltrating data. Any WordPress site running the plugin before version 1.8.5 that accepts FAQ submissions from unauthenticated visitors is affected. No public proof-of-concept or confirmed exploitation is known; exploitation probability is modest (EPSS 0.2% over 30 days) and the issue is not listed in CISA KEV.

What to do: Update FAQ Builder AYS to version 1.8.5 or later. Sites that cannot update immediately should disable or restrict front-end FAQ submissions to trusted users and review existing FAQ entries for injected HTML or scripts. Administrators should check logs for unexpected admin account creation or settings changes, since the payload executes with admin privileges.