CVE-2026-81737: FAQ Builder AYS WordPress XSS Vulnerability

CVE-2026-81737 Overview

CVE-2026-81737 is a Stored Cross-Site Scripting (XSS) vulnerability in the FAQ Builder AYS WordPress plugin versions before 1.8.5. The plugin accepts content from unauthenticated visitors without proper sanitization or escaping before persisting and rendering it in an administrative page. An escaping routine present in the code path is undone by a subsequent decoding step, negating the intended defense. When a logged-in administrator views the affected admin page, the injected JavaScript executes in their browser session, enabling account takeover, plugin modification, or malicious content injection across the site.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes with WordPress administrator privileges, leading to full site compromise.

Affected Products

FAQ Builder AYS WordPress plugin, all versions prior to 1.8.5
WordPress sites exposing the plugin's public FAQ submission functionality
Administrator accounts accessing the plugin's admin area

Discovery Timeline

2026-09-02 - CVE-2026-81737 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81737

Vulnerability Analysis

The flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. The FAQ Builder AYS plugin exposes a submission surface that unauthenticated visitors can use to send content, such as FAQ questions, into the WordPress database. The plugin fails to sanitize or escape this content before storing it. When an administrator later loads the plugin's admin page, the raw content is rendered inline, and any embedded script tags or event handlers execute in the administrator's authenticated browser context.

The attack requires user interaction from an administrator, specifically visiting the affected admin page. Because the payload is stored server-side, exploitation is persistent and triggers automatically for any administrator who navigates to the vulnerable view.

Root Cause

The root cause is twofold. First, the plugin does not apply sanitization functions such as sanitize_text_field() or wp_kses() to unauthenticated input. Second, an escaping call that would otherwise render output safe is followed by a decoding step that reverses the escaping. The output layer then interprets the decoded value as active HTML, allowing script execution.

Attack Vector

An unauthenticated remote attacker submits an FAQ or comparable content through the plugin's public form, embedding a JavaScript payload. The payload is stored verbatim. When an administrator opens the plugin's admin page, the browser parses the payload as executable script under the site's origin, granting the attacker access to session cookies, nonces, and administrative REST endpoints.

No verified public exploit code is available. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-81737

Indicators of Compromise

FAQ entries or plugin database records containing <script>, onerror=, onload=, or javascript: payloads
Unexpected administrator account creation, plugin installation, or theme file modification following admin logins
Outbound requests from administrator browsers to unfamiliar domains after loading the FAQ Builder AYS admin page

Detection Strategies

Query the WordPress wp_posts and plugin-specific tables for stored FAQ content matching HTML or script patterns
Review web server access logs for POST requests to the plugin's submission endpoint from unauthenticated sources
Deploy a web application firewall rule that flags script-like payloads submitted to FAQ Builder AYS endpoints

Monitoring Recommendations

Monitor administrator session activity for anomalous REST API calls originating shortly after admin page loads
Alert on changes to wp_users, wp_options, and plugin/theme files that follow administrator navigation to plugin pages
Track new file uploads or PHP writes in wp-content/ correlated with administrator sessions

How to Mitigate CVE-2026-81737

Immediate Actions Required

Update the FAQ Builder AYS plugin to version 1.8.5 or later on all WordPress installations
Audit stored FAQ content for HTML or JavaScript payloads and remove any malicious entries
Rotate administrator passwords and invalidate active sessions if the plugin has been exposed publicly

Patch Information

The vendor addressed the issue in FAQ Builder AYS version 1.8.5 by correcting the sanitization and output handling. Administrators should apply the update through the WordPress plugin dashboard or by manually replacing the plugin files. Confirm the installed version by checking the plugin metadata after the update.

Workarounds

Disable the FAQ Builder AYS plugin until the patched version can be installed
Restrict access to the plugin's public submission endpoint using a web application firewall or .htaccess rules
Require authentication for FAQ submissions where the plugin configuration allows it

bash

# Update FAQ Builder AYS via WP-CLI
wp plugin update faq-builder-ays --version=1.8.5
wp plugin list --name=faq-builder-ays --fields=name,status,version