CVEs we hold for Xenforo

Records whose assigning authority named Xenforo as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-74239XenForo < 2.3.13 Path Traversal via Style Archive Importer on WindowsXenForo

CVE-2026-73321XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode ParserXenForo

CVE-2026-73320XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl EndpointXenForo

CVE-2026-73319XenForo < 2.3.13 XSS via Dynamic Redirect HandlerXenForo

CVE-2026-73318XenForo < 2.3.13 Missing Authorization via force-agreement ControllerXenForo

CVE-2026-73317XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild DispatcherXenForo

CVE-2026-73316XenForo < 2.3.13 Payment Replay via PayPal REST Payment ProviderXenForo

CVE-2026-73315XenForo < 2.3.13 SSRF via PayPal REST Webhook HandlerXenForo

CVE-2026-73314XenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookXenForo

CVE-2026-73313XenForo < 2.3.13 MFA Bypass via Passkey TFA ProviderXenForo

CVE-2026-73312XenForo < 2.3.13 Refresh Token Replay via Expired Access TokenXenForo

CVE-2026-73311XenForo < 2.3.13 OAuth2 Authorization Code ReuseXenForo

CVE-2026-73310XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri BypassXenForo

CVE-2026-73309XenForo < 2.3.13 Authentication Bypass via OAuth2 Token EndpointXenForo

CVE-2026-35057XenForo Stored Cross-Site Scripting via Structured Text MentionsXenForo

CVE-2026-35056XenForo Remote Code Execution via Authenticated AdminXenForo

CVE-2026-35055XenForo Cross-Site Scripting via Lightbox in PostsXenForo

CVE-2026-35054XenForo Stored Cross-Site Scripting via BB Code RenderingXenForo

CVE-2025-71282XenForo Path Disclosure via open_basedir ExceptionsXenForo

CVE-2025-71281XenForo Template Method Call Restriction BypassXenForo

CVE-2025-71280XenForo Local Account Page Caching Information DisclosureXenForo

CVE-2025-71279XenForo Passkey Security BypassXenForo

CVE-2025-71278XenForo OAuth2 Unauthorized Scope RequestXenForo

CVE-2024-58342XenForo Open Redirect via getDynamicRedirectXenForo

CVE-2023-53904Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie CategoriesXenforo

25 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.