Xenforo vulnerabilities
25 published CVEs name Xenforo among the affected products.
- 25Published CVEs25 of them scored
- 25Last 12 monthspublished in the last year
- 4Critical11 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-74239
XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
XenForo · XenForo
High8.6 - CVE-2026-73321
XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
XenForo · XenForo
High7.1 - CVE-2026-73320
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
XenForo · XenForo
Medium5.1 - CVE-2026-73319
XenForo < 2.3.13 XSS via Dynamic Redirect Handler
XenForo · XenForo
Medium5.1 - CVE-2026-73318
XenForo < 2.3.13 Missing Authorization via force-agreement Controller
XenForo · XenForo
Medium5.1 - CVE-2026-73317
XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
XenForo · XenForo
Medium5.1 - CVE-2026-73316
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo · XenForo
High8.7 - CVE-2026-73315
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
XenForo · XenForo
High7.7 - CVE-2026-73314
XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
XenForo · XenForo
High8.7 - CVE-2026-73313
XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
XenForo · XenForo
High7.6