XXenForo

Products

Exploited and recent CVEs

• CVE-2026-74239 High 7.2 XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows 0.9%
• CVE-2026-73321 Medium 6.5 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser 0.6%
• CVE-2026-73320 Medium 6.1 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint 0.4%
• CVE-2026-73319 Medium 6.1 XenForo < 2.3.13 XSS via Dynamic Redirect Handler 0.4%
• CVE-2026-73318 Low 3.8 XenForo < 2.3.13 Missing Authorization via force-agreement Controller 0.5%
• CVE-2026-73317 Low 2.7 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher 0.4%
• CVE-2026-73316 High 7.5 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider 0.3%
• CVE-2026-73315 High 8.6 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler 0.4%
• CVE-2026-73314 High 7.5 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook 0.7%
• CVE-2026-73313 Medium 6.8 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider 0.6%
• CVE-2026-73312 High 7.4 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token 0.5%
• CVE-2026-73311 High 7.4 XenForo < 2.3.13 OAuth2 Authorization Code Reuse 0.5%
• CVE-2026-73310 Medium 5.9 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass 0.5%
• CVE-2026-73309 High 7.4 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint 0.7%
• CVE-2026-35057 Medium 6.4 XenForo Stored Cross-Site Scripting via Structured Text Mentions 0.2%
• CVE-2026-35056 High 7.2 XenForo Remote Code Execution via Authenticated Admin 0.7%
• CVE-2026-35055 Medium 6.1 XenForo Cross-Site Scripting via Lightbox in Posts 0.2%
• CVE-2026-35054 Medium 6.4 XenForo Stored Cross-Site Scripting via BB Code Rendering 0.1%
• CVE-2025-71282 High 7.5 XenForo Path Disclosure via open_basedir Exceptions 0.3%
• CVE-2025-71281 High 8.8 XenForo Template Method Call Restriction Bypass 0.3%
• CVE-2025-71280 Medium 6.2 XenForo Local Account Page Caching Information Disclosure 0.1%
• CVE-2025-71279 Critical 9.8 XenForo Passkey Security Bypass 0.5%
• CVE-2025-71278 High 8.8 XenForo OAuth2 Unauthorized Scope Request 0.3%
• CVE-2024-58342 Medium 6.3 XenForo Open Redirect via getDynamicRedirect 0.2%
• CVE-2023-53904 Medium 4.6 Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories 0.3%