XenForo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-74239 XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrHigh 8.6 · Sep 8, 2026
• CVE-2026-73321 XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of seHigh 7.1 · Sep 8, 2026
• CVE-2026-73316 XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multHigh 8.7 · Sep 8, 2026
• CVE-2026-73315 XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause theHigh 7.7 · Sep 8, 2026
• CVE-2026-73314 XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment sHigh 8.7 · Sep 8, 2026
• CVE-2026-73313 XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete High 7.6 · Sep 8, 2026
• CVE-2026-73312 XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mCritical 9.1 · Sep 8, 2026
• CVE-2026-73311 XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previouCritical 9.1 · Sep 8, 2026
• CVE-2026-73310 XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirHigh 8.2 · Sep 8, 2026
• CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pCritical 9.1 · Sep 8, 2026
• CVE-2026-35056 XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.High 8.6 · Mar 31, 2026
• CVE-2025-71282 XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions.High 8.7 · Mar 31, 2026
• CVE-2025-71281 XenForo before 2.3.7 does not properly restrict methods callable from within templates.High 8.7 · Mar 31, 2026
• CVE-2025-71279 XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts.Critical 9.3 · Mar 31, 2026
• CVE-2025-71278 XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes.High 8.7 · Mar 31, 2026
• CVE-2024-38458 Xenforo before 2.2.16 allows code injection.High 8.8 · Jun 16, 2024
• CVE-2024-38457 Xenforo before 2.2.16 allows CSRF.High 8.8 · Jun 16, 2024
• CVE-2024-25006 XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive fHigh 8.1 · Feb 28, 2024