CVE-2026-74239 | High | 7.2 | 2026-09-08 | XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administ… |
CVE-2026-73321 | Medium | 6.5 | 2026-09-08 | XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of s… |
CVE-2026-73320 | Medium | 6.1 | 2026-09-08 | XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records… |
CVE-2026-73319 | Medium | 6.1 | 2026-09-08 | XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary… |
CVE-2026-73318 | Low | 3.8 | 2026-09-08 | XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit f… |
CVE-2026-73317 | Low | 2.7 | 2026-09-08 | XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebui… |
CVE-2026-73316 | High | 7.5 | 2026-09-08 | XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload mul… |
CVE-2026-73315 | High | 8.6 | 2026-09-08 | XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause th… |
CVE-2026-73314 | High | 7.5 | 2026-09-08 | XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment… |
CVE-2026-73313 | Medium | 6.8 | 2026-09-08 | XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete… |
CVE-2026-73312 | High | 7.4 | 2026-09-08 | XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to… |
CVE-2026-73311 | High | 7.4 | 2026-09-08 | XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previo… |
CVE-2026-73310 | Medium | 5.9 | 2026-09-08 | XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redi… |
CVE-2026-73309 | High | 7.4 | 2026-09-08 | XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token… |
CVE-2026-35057 | Medium | 6.4 | 2026-04-01 | XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post… |
CVE-2026-35056 | High | 7.2 | 2026-04-01 | XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can… |
CVE-2026-35055 | Medium | 6.1 | 2026-04-01 | XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts… |
CVE-2026-35054 | Medium | 6.4 | 2026-04-01 | XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering. An attacker can inject malicious scripts through BB code… |
CVE-2025-71282 | High | 7.5 | 2026-04-01 | XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain informatio… |
CVE-2025-71281 | High | 8.8 | 2026-04-01 | XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match fo… |
CVE-2025-71280 | Medium | 6.2 | 2026-04-01 | XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a browser or machine… |
CVE-2025-71279 | Critical | 9.8 | 2026-04-01 | XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of… |
CVE-2025-71278 | High | 8.8 | 2026-04-01 | XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo… |
CVE-2024-58342 | Medium | 6.3 | 2026-04-01 | XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect t… |
CVE-2023-53904 | Medium | 4.6 | 2025-12-17 | Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie cat… |
CVE-2024-38458 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows code injection. |
CVE-2024-38457 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows CSRF. |
CVE-2024-25006 | High | 8.1 | 2024-02-29 | XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive… |
CVE-2021-43032 | Medium | 4.8 | 2021-11-03 | In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in… |