CVE-2026-81737

Name of the Vulnerable Software and Affected Versions FAQ Builder AYS versions prior to 1.8.5

Description Stored Cross-Site Scripting (XSS) occurs when the plugin fails to properly sanitize or escape content submitted by unauthenticated visitors. Although some escaping is applied, a subsequent decoding step reverses it before the content is stored and displayed on an admin area page. This allows malicious scripts to execute within the session of a logged-in administrator via the ays get user information function.

Recommendations Update FAQ Builder AYS to version 1.8.5 or later.