# cve.now: Xenforo

The newest entries naming Xenforo as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-74239](https://cve.now/CVE-2026-74239.md): XenForo \< 2.3.13 Path Traversal via Style Archive Importer on Windows (CVSS 8.6)
- [CVE-2026-73321](https://cve.now/CVE-2026-73321.md): XenForo \< 2.3.13 Uncontrolled Recursion DoS via BBCode Parser (CVSS 7.1)
- [CVE-2026-73320](https://cve.now/CVE-2026-73320.md): XenForo \< 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint (CVSS 5.1)
- [CVE-2026-73319](https://cve.now/CVE-2026-73319.md): XenForo \< 2.3.13 XSS via Dynamic Redirect Handler (CVSS 5.1)
- [CVE-2026-73318](https://cve.now/CVE-2026-73318.md): XenForo \< 2.3.13 Missing Authorization via force-agreement Controller (CVSS 5.1)
- [CVE-2026-73317](https://cve.now/CVE-2026-73317.md): XenForo \< 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher (CVSS 5.1)
- [CVE-2026-73316](https://cve.now/CVE-2026-73316.md): XenForo \< 2.3.13 Payment Replay via PayPal REST Payment Provider (CVSS 8.7)
- [CVE-2026-73315](https://cve.now/CVE-2026-73315.md): XenForo \< 2.3.13 SSRF via PayPal REST Webhook Handler (CVSS 7.7)
- [CVE-2026-73314](https://cve.now/CVE-2026-73314.md): XenForo \< 2.3.13 Signature Verification Bypass via PayPal REST Webhook (CVSS 8.7)
- [CVE-2026-73313](https://cve.now/CVE-2026-73313.md): XenForo \< 2.3.13 MFA Bypass via Passkey TFA Provider (CVSS 7.6)
- [CVE-2026-73312](https://cve.now/CVE-2026-73312.md): XenForo \< 2.3.13 Refresh Token Replay via Expired Access Token (CVSS 9.1)
- [CVE-2026-73311](https://cve.now/CVE-2026-73311.md): XenForo \< 2.3.13 OAuth2 Authorization Code Reuse (CVSS 9.1)
- [CVE-2026-73310](https://cve.now/CVE-2026-73310.md): XenForo \< 2.3.13 OAuth2 Authorization Code Token Theft via redirect\_uri Bypass (CVSS 8.2)
- [CVE-2026-73309](https://cve.now/CVE-2026-73309.md): XenForo \< 2.3.13 Authentication Bypass via OAuth2 Token Endpoint (CVSS 9.1)
- [CVE-2026-35057](https://cve.now/CVE-2026-35057.md): XenForo Stored Cross-Site Scripting via Structured Text Mentions (CVSS 5.1)
- [CVE-2026-35056](https://cve.now/CVE-2026-35056.md): XenForo Remote Code Execution via Authenticated Admin (CVSS 8.6)
- [CVE-2026-35055](https://cve.now/CVE-2026-35055.md): XenForo Cross-Site Scripting via Lightbox in Posts (CVSS 5.1)
- [CVE-2026-35054](https://cve.now/CVE-2026-35054.md): XenForo Stored Cross-Site Scripting via BB Code Rendering (CVSS 5.1)
- [CVE-2025-71282](https://cve.now/CVE-2025-71282.md): XenForo Path Disclosure via open\_basedir Exceptions (CVSS 8.7)
- [CVE-2025-71281](https://cve.now/CVE-2025-71281.md): XenForo Template Method Call Restriction Bypass (CVSS 8.7)
- [CVE-2025-71280](https://cve.now/CVE-2025-71280.md): XenForo Local Account Page Caching Information Disclosure (CVSS 6.9)
- [CVE-2025-71279](https://cve.now/CVE-2025-71279.md): XenForo Passkey Security Bypass (CVSS 9.3)
- [CVE-2025-71278](https://cve.now/CVE-2025-71278.md): XenForo OAuth2 Unauthorized Scope Request (CVSS 8.7)
- [CVE-2024-58342](https://cve.now/CVE-2024-58342.md): XenForo Open Redirect via getDynamicRedirect (CVSS 5.3)
- [CVE-2023-53904](https://cve.now/CVE-2023-53904.md): Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories (CVSS 5.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/xenforo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.