CVE-2026-94391: Ultimate FAQ Plugin XSS Vulnerability

CVE-2026-94391 Overview

CVE-2026-94391 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Ultimate FAQ plugin for WordPress in versions up to and including 2.4.14. The flaw allows authenticated users at the Contributor role or higher to inject arbitrary JavaScript that executes in the browsers of users who view the affected content. Because the attack requires user interaction and only low-privileged authentication, it primarily threatens multi-author WordPress sites where Contributor accounts exist. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in administrator browsers, enabling session theft, forced actions, and potential site takeover.

Affected Products

WordPress Ultimate FAQ plugin versions <= 2.4.14
WordPress sites permitting Contributor-level accounts
Multi-author WordPress environments using Ultimate FAQ for content management

Discovery Timeline

2026-09-23 - CVE-2026-94391 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94391

Vulnerability Analysis

The Ultimate FAQ plugin fails to properly sanitize user-supplied input before rendering it in the WordPress admin or public-facing pages. A user with Contributor privileges can craft FAQ entries containing HTML and JavaScript payloads. When another user, typically an editor or administrator, loads the affected view, the injected script executes in that user's authenticated session.

The scope-changed nature of the flaw means the malicious script can act beyond the attacker's own privilege level. Successful exploitation can lead to administrative action forgery, cookie exfiltration, plugin installation, or persistent backdoor creation through the WordPress REST API.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Input submitted through FAQ creation endpoints is not filtered with functions such as wp_kses_post() or escaped on output with esc_html() or esc_attr(). This omission permits raw <script> tags or event handler attributes to persist in the database and render as executable HTML.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated Contributor account. The attacker submits an FAQ item containing a malicious payload, then waits for a higher-privileged user to view the FAQ list, preview, or moderation queue. User interaction is required to trigger the payload, which distinguishes this from unauthenticated stored XSS. See the Patchstack Vulnerability Advisory for further technical context.

Detection Methods for CVE-2026-94391

Indicators of Compromise

FAQ posts containing <script>, onerror=, onload=, or javascript: strings stored in the wp_posts table
Unexpected administrative actions performed shortly after an administrator viewed FAQ content
New administrator accounts, plugin installations, or theme edits without a corresponding audit trail
Outbound requests from administrator browsers to attacker-controlled domains

Detection Strategies

Query the WordPress database for FAQ entries containing HTML event handlers or <script> tags authored by Contributor accounts
Review web server access logs for POST requests to FAQ creation endpoints originating from low-privilege sessions
Enable and monitor a Content Security Policy (CSP) in report-only mode to surface inline script execution on admin pages

Monitoring Recommendations

Audit WordPress role changes and new user creation events for unexpected privilege escalation
Track plugin installations, theme modifications, and edits to wp-config.php for indicators of post-exploitation activity
Alert on anomalous administrator session activity, particularly REST API calls made immediately after viewing contributor-authored content

How to Mitigate CVE-2026-94391

Immediate Actions Required

Update the Ultimate FAQ plugin to a version later than 2.4.14 as soon as the vendor releases a fix
Audit all existing FAQ entries for stored HTML or JavaScript payloads and remove suspicious content
Review Contributor accounts and disable or reset credentials for any that appear inactive or unauthorized
Rotate administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

Refer to the Patchstack Vulnerability Advisory for the current patched version. Apply the vendor update through the WordPress plugin manager or WP-CLI, then verify the installed version is above 2.4.14.

Workarounds

Temporarily restrict Contributor-level account creation and require Editor approval for FAQ submissions
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and event handlers in FAQ submission parameters
Implement a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Disable the Ultimate FAQ plugin if patching is not immediately feasible and the feature is non-critical

bash

# Configuration example: update Ultimate FAQ via WP-CLI and verify version
wp plugin update ultimate-faqs
wp plugin get ultimate-faqs --field=version

# List Contributor accounts for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered