[HIGH] phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

PKSA-xsdh-jbbj-vv28 CVE-2026-56736 GHSA-pgwp-vc7q-cvj3

Affected version: <4.2.0-alpha

Reported by:
GitHub

[MEDIUM] phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

PKSA-cz4f-38kk-4ywj CVE-2026-47132 GHSA-6pvm-2vjj-rx4w

Affected version: <4.2.0-alpha

Reported by:
GitHub