CVE-2026-34729: phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

The sanitization pipeline for FAQ content is:

1. Filter::filterVar($input, FILTER_SANITIZE_SPECIAL_CHARS) — encodes <, >, ", ', & to HTML entities
2. html_entity_decode($input, ENT_QUOTES | ENT_HTML5) — decodes entities back to characters
3. Filter::removeAttributes($input) — removes dangerous HTML attributes

The removeAttributes() regex at line 174 only matches attributes with double-quoted values:

preg_match_all(pattern: '/[a-z]+=".+"/iU', subject: $html, matches: $attributes);

This regex does NOT match:

• Attributes with single quotes: onerror='alert(1)'
• Attributes without quotes: onerror=alert(1)

An attacker can bypass sanitization by submitting FAQ content with unquoted or single-quoted event handler attributes.