CVE-2026-25346
Published: 25 March 2026
Summary
CVE-2026-25346 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters information prior to output to web pages, directly preventing cross-site scripting attacks from unneutralized inputs as in this CVE.
Validates inputs to reject or sanitize malicious content, blocking the injection of scripts exploited in this XSS vulnerability.
Mandates timely identification, reporting, and patching of flaws like this XSS vulnerability in the WordPress plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS in public-facing WordPress plugin directly enables T1190 exploitation; UI:R + malicious script delivery maps to T1189 drive-by; explicit session hijacking/data theft enables T1539 cookie theft.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.
Deeper analysisAI
CVE-2026-25346 is an improper neutralization of input during web page generation vulnerability, classified as cross-site scripting (XSS) under CWE-79, in the Ays Pro FAQ Builder (faq-builder-ays) WordPress plugin. This issue affects all versions from n/a through 1.8.2 and was published on 2026-03-25. The vulnerability enables exploiting incorrectly configured access control security levels, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R), such as tricking a victim into interacting with malicious content. Successful exploitation changes scope (S:C), allowing low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially leading to session hijacking, data theft, or minor disruptions in the context of the affected WordPress site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/faq-builder-ays/vulnerability/wordpress-faq-builder-ays-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 1.8.2.
Details
- CWE(s)