CVE-2026-35057

Published April 1st, 2026

View on NVD ↗

CVSS v3

6.4

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.

methosiea/xenforo-2-xss

XenForo 2.x - Stored XSS via Placeholder Collision

GitHub