Xenforo vulnerabilities

Products

• Xenforo 29

Newest

• xenforo XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows CVE-2026-74239 Public exploit 8.6 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser CVE-2026-73321 Public exploit 7.1 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint CVE-2026-73320 Public exploit 5.1 MediumSeptember 8, 2026
• xenforo XenForo < 2.3.13 XSS via Dynamic Redirect Handler CVE-2026-73319 Public exploit 5.1 MediumSeptember 8, 2026
• xenforo XenForo < 2.3.13 Missing Authorization via force-agreement Controller CVE-2026-73318 Public exploit 5.1 MediumSeptember 8, 2026
• xenforo XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher CVE-2026-73317 Public exploit 5.1 MediumSeptember 8, 2026
• xenforo XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider CVE-2026-73316 Public exploit 8.7 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler CVE-2026-73315 Public exploit 7.7 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook CVE-2026-73314 Public exploit 8.7 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider CVE-2026-73313 Public exploit 7.6 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 Refresh Token Replay via Expired Access Token CVE-2026-73312 Public exploit 9.1 CriticalSeptember 8, 2026
• xenforo XenForo < 2.3.13 OAuth2 Authorization Code Reuse CVE-2026-73311 Public exploit 9.1 CriticalSeptember 8, 2026
• xenforo XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass CVE-2026-73310 Public exploit 8.2 HighSeptember 8, 2026
• xenforo XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint CVE-2026-73309 Public exploit 9.1 CriticalSeptember 8, 2026
• xenforo XenForo Stored Cross-Site Scripting via Structured Text Mentions CVE-2026-35057 5.1 MediumApril 1, 2026
• xenforo XenForo Remote Code Execution via Authenticated Admin CVE-2026-35056 8.6 HighApril 1, 2026
• xenforo XenForo Cross-Site Scripting via Lightbox in Posts CVE-2026-35055 5.1 MediumApril 1, 2026
• xenforo XenForo Stored Cross-Site Scripting via BB Code Rendering CVE-2026-35054 5.1 MediumApril 1, 2026
• xenforo XenForo Path Disclosure via open_basedir Exceptions CVE-2025-71282 8.7 HighApril 1, 2026
• xenforo XenForo Template Method Call Restriction Bypass CVE-2025-71281 8.7 HighApril 1, 2026
• xenforo XenForo Local Account Page Caching Information Disclosure CVE-2025-71280 6.9 MediumApril 1, 2026
• xenforo XenForo Passkey Security Bypass CVE-2025-71279 9.3 CriticalApril 1, 2026
• xenforo XenForo OAuth2 Unauthorized Scope Request CVE-2025-71278 8.7 HighApril 1, 2026
• xenforo XenForo Open Redirect via getDynamicRedirect CVE-2024-58342 5.3 MediumApril 1, 2026
• xenforo Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories CVE-2023-53904 5.1 MediumDecember 17, 2025
• xenforo Xenforo before 2.2.16 allows code injection. CVE-2024-38458 8.8 HighJune 16, 2024
• xenforo Xenforo before 2.2.16 allows CSRF. CVE-2024-38457 8.8 HighJune 16, 2024
• xenforo XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who... CVE-2024-25006 8.1 HighFebruary 2, 2024
• xenforo In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new... CVE-2021-43032 Public exploit 4.8 MediumNovember 3, 2021