Xenforo vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202624

Newest CVEs

• CVE-2026-74239

  XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

  XenForo · XenForo

  High8.6
• CVE-2026-73321

  XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser

  XenForo · XenForo

  High7.1
• CVE-2026-73320

  XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

  XenForo · XenForo

  Medium5.1
• CVE-2026-73319

  XenForo < 2.3.13 XSS via Dynamic Redirect Handler

  XenForo · XenForo

  Medium5.1
• CVE-2026-73318

  XenForo < 2.3.13 Missing Authorization via force-agreement Controller

  XenForo · XenForo

  Medium5.1
• CVE-2026-73317

  XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

  XenForo · XenForo

  Medium5.1
• CVE-2026-73316

  XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider

  XenForo · XenForo

  High8.7
• CVE-2026-73315

  XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler

  XenForo · XenForo

  High7.7
• CVE-2026-73314

  XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook

  XenForo · XenForo

  High8.7
• CVE-2026-73313

  XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider

  XenForo · XenForo

  High7.6