Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: XenForo — XenForo 2.3.9 (inc XFMG) & 2.2.18 Released (Security Fix) Clear all filters
TI-2026-27259 CVE-2026-35056 · GHSA-wrgm-wvxf-c44c

XenForo Remote Code Execution via Authenticated Admin

Priority MEDIUM 40

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00678 Published 2026-04-01 Fixed in 2.3.9, 2.2.18 CWE-94
TI-2026-27258 CVE-2026-35055 · GHSA-7285-3w46-g6m6

XenForo Cross-Site Scripting via Lightbox in Posts

Priority LOW 22

XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00161 Published 2026-04-01 Fixed in 2.3.9, 2.2.18 CWE-79
TI-2026-27257 CVE-2026-35054 · GHSA-2ch2-j7qp-pqm3

XenForo Stored Cross-Site Scripting via BB Code Rendering

Priority LOW 22

XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00143 Published 2026-04-01 Fixed in 2.3.9 CWE-79