Ultimate Faqs Vulnerabilities

The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling html_entity_decode() on post_content during rendering in the set_display_variables() function (View.FAQ.class.php, line 746), which...

CVSS:

6.4

Affected:

up to 2.4.7

Fixed in:

2.4.8

Disclosed:

Apr 8, 2026

CVE-2026-4336 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.

Affected:

up to 2.4.3

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67590 on NVD →

The Ultimate FAQ Accordion Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can tric...

CVSS:

4.3

Affected:

up to 2.4.3

Fixed in:

2.4.4

Disclosed:

Nov 8, 2025

CVE-2025-67590 on NVD →

[en] The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions

Affected:

up to 2.1.2

Fixed in:

2.1.2

Disclosed:

Jan 24, 2022

CVE-2021-24968 on NVD →

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions

CVSS:

5.7

Affected:

up to 2.1.2

Fixed in:

2.1.2

Disclosed:

Dec 27, 2021

CVE-2021-24968 on NVD →

[en] The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

Affected:

up to 1.8.30

Fixed in:

1.8.30

Disclosed:

Jan 16, 2020

CVE-2020-7107 on NVD →

Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability found in WordPress Ultimate FAQ plugin (versions <= 1.8.29).

Affected:

up to 1.8.30

Fixed in:

1.8.30

Disclosed:

Jan 7, 2020

The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

CVSS:

6.1

Affected:

up to 1.8.29

Fixed in:

1.8.30

Disclosed:

Jan 6, 2020

CVE-2020-7107 on NVD →

[en] Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

Affected:

up to 1.8.25

Fixed in:

1.8.25

Disclosed:

Oct 7, 2019

CVE-2019-17233 on NVD →

[en] Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.

Affected:

up to 1.8.25

Fixed in:

1.8.25

Disclosed:

Oct 7, 2019

CVE-2019-17232 on NVD →

Unauthenticated Options Import/Export vulnerability found by Jerome Bruandet in WordPress Ultimate FAQ plugin (versions <= 1.8.24).

Affected:

up to 1.8.25

Fixed in:

1.8.25

Disclosed:

Sep 23, 2019

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.

CVSS:

9.1

Affected:

up to 1.8.25

Fixed in:

1.8.25

Disclosed:

Sep 20, 2019

CVE-2019-17232 on NVD →

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

CVSS:

6.1

Affected:

up to 1.8.25

Fixed in:

1.8.25

Disclosed:

Sep 20, 2019

CVE-2019-17233 on NVD →

[en] The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.

Affected:

up to 1.8.22

Fixed in:

1.8.22

Disclosed:

Aug 27, 2019

CVE-2019-15643 on NVD →

The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 1.8.22

Fixed in:

1.8.22

Disclosed:

May 8, 2019

CVE-2019-15643 on NVD →