Xenforo
11 CVEs across 1 Xenforo products. Browse Xenforo vulnerabilities, severities, and proof-of-concept exploits.
Xenforo products with known CVEs
Xenforo CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-35057 | Medium | 6.4 | 2026-04-01 | XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post… |
CVE-2026-35056 | High | 7.2 | 2026-04-01 | XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can… |
CVE-2026-35055 | Medium | 6.1 | 2026-04-01 | XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts… |
CVE-2026-35054 | Medium | 6.4 | 2026-04-01 | XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering. An attacker can inject malicious scripts through BB code… |
CVE-2025-71282 | High | 7.5 | 2026-04-01 | XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain informatio… |
CVE-2025-71281 | High | 8.8 | 2026-04-01 | XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match fo… |
CVE-2025-71280 | Medium | 6.2 | 2026-04-01 | XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a browser or machine… |
CVE-2025-71279 | Critical | 9.8 | 2026-04-01 | XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of… |
CVE-2025-71278 | High | 8.8 | 2026-04-01 | XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo… |
CVE-2024-58342 | Medium | 6.3 | 2026-04-01 | XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect t… |
CVE-2023-53904 | Medium | 4.6 | 2025-12-17 | Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie cat… |
CVE-2024-38458 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows code injection. |
CVE-2024-38457 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows CSRF. |
CVE-2024-25006 | High | 8.1 | 2024-02-29 | XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive… |
CVE-2021-43032 | Medium | 4.8 | 2021-11-03 | In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in… |