CVE-2026-94391

MediumCVSS 6.5

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in the Ultimate FAQ plugin in versions up to and including 2.4.14. The vulnerability can be exploited by a user with Contributor privileges.

Risk Assessment

A user with Contributor privileges can inject malicious script that executes in other users' browsers, including administrators. This may lead to session theft or account takeover.

Recommendation

Update the Ultimate FAQ plugin to a version newer than 2.4.14. Verify no other vulnerable plugins exist and limit the number of Contributor accounts.

Other vulnerabilities in Ultimate FAQ

CVE-2025-67590Medium
The Ultimate FAQ plugin (versions up to and including 2.4.3) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS