Xenforo vulnerabilities
25 CVEs and advisories name Xenforo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-74239XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
- CVE-2026-73321XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
- CVE-2026-73320XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
- CVE-2026-73319XenForo < 2.3.13 XSS via Dynamic Redirect Handler
- CVE-2026-73318XenForo < 2.3.13 Missing Authorization via force-agreement Controller
- CVE-2026-73317XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
- CVE-2026-73316XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
- CVE-2026-73315XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
- CVE-2026-73314XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
- CVE-2026-73313XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
- CVE-2026-73312XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
- CVE-2026-73311XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- CVE-2026-73310XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
- CVE-2026-73309XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
- CVE-2026-35057XenForo Stored Cross-Site Scripting via Structured Text Mentions
- CVE-2026-35056XenForo Remote Code Execution via Authenticated Admin
- CVE-2026-35055XenForo Cross-Site Scripting via Lightbox in Posts
- CVE-2026-35054XenForo Stored Cross-Site Scripting via BB Code Rendering
- CVE-2025-71282XenForo Path Disclosure via open_basedir Exceptions
- CVE-2025-71281XenForo Template Method Call Restriction Bypass
- CVE-2025-71280XenForo Local Account Page Caching Information Disclosure
- CVE-2025-71279XenForo Passkey Security Bypass
- CVE-2025-71278XenForo OAuth2 Unauthorized Scope Request
- CVE-2024-58342XenForo Open Redirect via getDynamicRedirect
- CVE-2023-53904Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories