PT-2026-29429 · Xenforo · Xenforo

Antisocial · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-35054

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.9

Description XenForo before version 2.3.9 is susceptible to stored cross-site scripting (XSS) due to issues in how BB code is processed. An attacker can inject malicious scripts using BB code. This code is then saved and executed when other users view the content, potentially compromising their accounts or data.

Recommendations Update XenForo to version 2.3.9 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35054

Affected Products

Xenforo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-35054 · Security Note
• https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659 · Vendor Advisory, Patch
• https://vulncheck.com/advisories/xenforo-stored-cross-site-scripting-via-bb-code-rendering · Note
• https://twitter.com/CVEarity/status/2039273819303801205 · Twitter Post
• https://twitter.com/CVEnew/status/2039279701076873469 · Twitter Post