methosiea/xenforo-2-xss

methosiea/xenforo-2-xss

GitHubGitHub
GitHubgithub.com
xenforo.comxenforo.com
Releases0
Stars1
XenForo 2.x - Stored XSS via Placeholder Collision
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2026-35057↗
6.4 MEDIUM—

XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.