XenForo Security Vulnerabilities | CyStack CVE Database

Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

XenForo Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-74239`XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73321`XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73320`XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityMedium
`CVE-2026-73319`XenForo < 2.3.13 XSS via Dynamic Redirect Handler	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityMedium
`CVE-2026-73318`XenForo < 2.3.13 Missing Authorization via force-agreement Controller	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityMedium
`CVE-2026-73317`XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityMedium
`CVE-2026-73316`XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73315`XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73314`XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73313`XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73312`XenForo < 2.3.13 Refresh Token Replay via Expired Access Token	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityCritical
`CVE-2026-73311`XenForo < 2.3.13 OAuth2 Authorization Code Reuse	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityCritical
`CVE-2026-73310`XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityHigh
`CVE-2026-73309`XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published09/08/2026	SeverityCritical
`CVE-2026-35057`XenForo Stored Cross-Site Scripting via Structured Text Mentions	Exploitation statusPublic exploit	FixYes	Affected productXenForo	Published04/01/2026	SeverityMedium
`CVE-2026-35056`XenForo Remote Code Execution via Authenticated Admin	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityHigh
`CVE-2026-35055`XenForo Cross-Site Scripting via Lightbox in Posts	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityMedium
`CVE-2026-35054`XenForo Stored Cross-Site Scripting via BB Code Rendering	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityMedium
`CVE-2025-71282`XenForo Path Disclosure via open_basedir Exceptions	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityHigh
`CVE-2025-71281`XenForo Template Method Call Restriction Bypass	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityHigh
`CVE-2025-71280`XenForo Local Account Page Caching Information Disclosure	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityMedium
`CVE-2025-71279`XenForo Passkey Security Bypass	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityCritical
`CVE-2025-71278`XenForo OAuth2 Unauthorized Scope Request	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityHigh
`CVE-2024-58342`XenForo Open Redirect via getDynamicRedirect	Exploitation statusNot known exploited	FixYes	Affected productXenForo	Published04/01/2026	SeverityMedium
`CVE-2023-53904`Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories	Exploitation statusPublic exploit	FixNot confirmed	Affected productXenForo	Published12/17/2025	SeverityMedium
`CVE-2024-38458`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/16/2024	SeverityHigh
`CVE-2024-38457`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published06/16/2024	SeverityHigh
`CVE-2024-25006`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published02/02/2024	SeverityHigh
`CVE-2021-43032`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/03/2021	SeverityUnknown

29 / 29 Results

All vulnerabilities loaded

Security vulnerabilities from XenForo

XenForo

How many security vulnerabilities does XenForo have?

Which XenForo product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular XenForo products

XenForo