Executive brief
The FAQ Builder AYS WordPress plugin is used by website administrators to manage frequently asked questions. An unauthenticated attacker can submit malicious code through the plugin's user information form that gets stored in the admin panel, then executed with full administrator privileges when an admin accesses the affected area. This could allow attackers to compromise the entire WordPress site, steal admin credentials, or inject malware.
Technical details
This is a Stored XSS vulnerability (CWE-79) in the FAQ Builder AYS WordPress plugin versions 1.6.3–1.8.4. The plugin fails to properly sanitize user-submitted content in the ays_get_user_information function before storing it to the database and displaying it in the admin panel. Additionally, any escaping applied by the plugin is defeated by a subsequent HTML decoding step, allowing malicious JavaScript to reach stored content. The attack requires no authentication—any unauthenticated visitor can submit the payload—and execution occurs in the admin dashboard context, giving the attacker full admin-level capabilities. The vulnerability was patched in version 1.8.5.
Affected products
- AYS FAQ Builder 1.6.3–1.8.4
Timeline
- 2026-08-31: disclosed
- 2026-??-??: patched: Fixed in version 1.8.5