PT-2026-29432 · Xenforo · Xenforo

Metho · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-35057

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.10 and prior to 2.2.19

Description XenForo is susceptible to stored cross-site scripting (XSS) within structured text mentions, primarily impacting legacy profile post content. An attacker can inject malicious scripts through crafted mentions. These malicious scripts are stored and executed when other users view the affected content.

Recommendations Update to XenForo version 2.3.10 or later. Update to XenForo version 2.2.19 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35057

Affected Products

Xenforo

References · 6

• 🔥 https://github.com/methosiea/xenforo-2-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35057 · Security Note
• https://twitter.com/CVEnew/status/2039279697637654911 · Twitter Post
• https://twitter.com/CVEarity/status/2039282156325970282 · Twitter Post
• https://vulncheck.com/advisories/xenforo-stored-cross-site-scripting-via-structured-text-mentions · Note
• https://xenforo.com/community/threads/xenforo-2-3-10-add-ons-and-2-2-19-released-includes-security-fix.236249 · Vendor Advisory, Patch