Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Xenforo — Vulnerabilities & Security Advisories 25

All 25 CVE vulnerabilities found in Xenforo, with AI-generated Chinese analysis, references, and POCs.

This page documents known weakness types affecting Xenforo, a popular forum software platform. It aggregates security vulnerabilities discovered across various versions of the Xenforo product suite. The data covers vulnerabilities identified and publicly disclosed from early inception through recent years, ensuring a comprehensive historical view. Readers can use this resource to track vendor advisories related to Xenforo, gaining insight into how the maintainer addresses security issues over time. Users can also deepen their understanding of specific weakness classes by examining how they manifest within the Xenforo codebase and deployment models. Additionally, the page allows for looking up a product's vulnerability history, providing context on the frequency and severity of past security incidents. This approach helps security professionals assess risk exposure and prioritize remediation efforts effectively. By consolidating these data points, the page serves as a centralized reference for evaluating the security posture of Xenforo installations. It supports informed decision-making regarding upgrades, patching strategies, and configuration hardening. The information presented is strictly factual, focusing on technical details rather than promotional content. This ensures that users receive accurate and actionable intelligence relevant to their security operations and compliance requirements.

Vendor: Xenforo

CVE ID Title CVSS Severity Published
CVE-2026-74239 XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows CWE-22 7.2 High 2026-09-08
CVE-2026-73321 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser CWE-674 6.5 Medium 2026-09-08
CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint CWE-639 6.1 Medium 2026-09-08
CVE-2026-73319 XenForo < 2.3.13 XSS via Dynamic Redirect Handler CWE-79 6.1 Medium 2026-09-08
CVE-2026-73318 XenForo < 2.3.13 Missing Authorization via force-agreement Controller CWE-863 3.8 Low 2026-09-08
CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher CWE-863 2.7 Low 2026-09-08
CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider CWE-345 7.5 High 2026-09-08
CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler CWE-918 8.6 High 2026-09-08
CVE-2026-73314 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook CWE-754 7.5 High 2026-09-08
CVE-2026-73313 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider CWE-863 6.8 Medium 2026-09-08
CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token CWE-294 7.4 High 2026-09-08
CVE-2026-73311 XenForo < 2.3.13 OAuth2 Authorization Code Reuse CWE-294 7.4 High 2026-09-08
CVE-2026-73310 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass CWE-863 5.9 Medium 2026-09-08
CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint CWE-697 7.4 High 2026-09-08
CVE-2026-35057 XenForo Stored Cross-Site Scripting via Structured Text Mentions CWE-79 6.4 Medium 2026-04-01
CVE-2026-35056 XenForo Remote Code Execution via Authenticated Admin CWE-94 7.2 High 2026-04-01
CVE-2026-35055 XenForo Cross-Site Scripting via Lightbox in Posts CWE-79 6.1 Medium 2026-04-01
CVE-2025-71282 XenForo Path Disclosure via open_basedir Exceptions CWE-209 7.5 High 2026-04-01
CVE-2026-35054 XenForo Stored Cross-Site Scripting via BB Code Rendering CWE-79 6.4 Medium 2026-04-01
CVE-2025-71281 XenForo Template Method Call Restriction Bypass CWE-94 8.8 High 2026-04-01
CVE-2025-71280 XenForo Local Account Page Caching Information Disclosure CWE-200 6.2 Medium 2026-04-01
CVE-2025-71279 XenForo Passkey Security Bypass CWE-287 9.8 Critical 2026-04-01
CVE-2025-71278 XenForo OAuth2 Unauthorized Scope Request CWE-863 8.8 High 2026-04-01
CVE-2024-58342 XenForo Open Redirect via getDynamicRedirect CWE-601 6.3 Medium 2026-04-01
CVE-2023-53904 Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories CWE-79 4.6 Medium 2025-12-17

All 25 known CVE vulnerabilities affecting Xenforo with full Chinese analysis, references, and POCs where available.