CVE-2026-35054

MEDIUM CVSS 6.4 View on NVD ↗

Description

XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected Products

xenforo/xenforo

References

https://www.vulncheck.com/advisories/xenforo-stored-cross-site-scripting-via-bb-code-rendering
https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/

Published: Apr 01, 2026 01:16 UTC Modified: Apr 01, 2026 18:51 UTC