PT-2026-29430 · Xenforo · Xenforo

Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-35055

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.9 and prior to 2.2.18

Description XenForo is susceptible to cross-site scripting (XSS) due to the way lightbox is used in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.

Recommendations Update to XenForo version 2.3.9 or later Update to XenForo version 2.2.18 or later

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35055

Affected Products

Xenforo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-35055 · Security Note
• https://twitter.com/CVEarity/status/2039276598516695062 · Twitter Post
• https://vulncheck.com/advisories/xenforo-cross-site-scripting-via-lightbox-in-posts · Note
• https://twitter.com/CVEnew/status/2039279700003172738 · Twitter Post
• https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659 · Vendor Advisory, Patch