# XenForo.

Every CVE that names XenForo among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows](https://agentprime.io/advisories/CVE-2026-74239.md)
  `CVE-2026-74239` · CVE record: XenForo XenForo · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser](https://agentprime.io/advisories/CVE-2026-73321.md)
  `CVE-2026-73321` · CVE record: XenForo XenForo · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint](https://agentprime.io/advisories/CVE-2026-73320.md)
  `CVE-2026-73320` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [XenForo < 2.3.13 XSS via Dynamic Redirect Handler](https://agentprime.io/advisories/CVE-2026-73319.md)
  `CVE-2026-73319` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [XenForo < 2.3.13 Missing Authorization via force-agreement Controller](https://agentprime.io/advisories/CVE-2026-73318.md)
  `CVE-2026-73318` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher](https://agentprime.io/advisories/CVE-2026-73317.md)
  `CVE-2026-73317` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider](https://agentprime.io/advisories/CVE-2026-73316.md)
  `CVE-2026-73316` · CVE record: XenForo XenForo · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-345
- [XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler](https://agentprime.io/advisories/CVE-2026-73315.md)
  `CVE-2026-73315` · CVE record: XenForo XenForo · CVSS 7.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook](https://agentprime.io/advisories/CVE-2026-73314.md)
  `CVE-2026-73314` · CVE record: XenForo XenForo · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-754
- [XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider](https://agentprime.io/advisories/CVE-2026-73313.md)
  `CVE-2026-73313` · CVE record: XenForo XenForo · CVSS 7.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [XenForo < 2.3.13 Refresh Token Replay via Expired Access Token](https://agentprime.io/advisories/CVE-2026-73312.md)
  `CVE-2026-73312` · CVE record: XenForo XenForo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [XenForo < 2.3.13 OAuth2 Authorization Code Reuse](https://agentprime.io/advisories/CVE-2026-73311.md)
  `CVE-2026-73311` · CVE record: XenForo XenForo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass](https://agentprime.io/advisories/CVE-2026-73310.md)
  `CVE-2026-73310` · CVE record: XenForo XenForo · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint](https://agentprime.io/advisories/CVE-2026-73309.md)
  `CVE-2026-73309` · CVE record: XenForo XenForo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-697
- [XenForo Stored Cross-Site Scripting via Structured Text Mentions](https://agentprime.io/advisories/CVE-2026-35057.md)
  `CVE-2026-35057` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS)
- [XenForo Remote Code Execution via Authenticated Admin](https://agentprime.io/advisories/CVE-2026-35056.md)
  `CVE-2026-35056` · CVE record: XenForo XenForo · CVSS 8.6 High · Not analysed yet · Published 1 Apr 2026 · Tags: Code injection
- [XenForo Cross-Site Scripting via Lightbox in Posts](https://agentprime.io/advisories/CVE-2026-35055.md)
  `CVE-2026-35055` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS)
- [XenForo Stored Cross-Site Scripting via BB Code Rendering](https://agentprime.io/advisories/CVE-2026-35054.md)
  `CVE-2026-35054` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS)
- [XenForo Path Disclosure via open_basedir Exceptions](https://agentprime.io/advisories/CVE-2025-71282.md)
  `CVE-2025-71282` · CVE record: XenForo XenForo · CVSS 8.7 High · Not analysed yet · Published 1 Apr 2026 · Tags: Information disclosure
- [XenForo Template Method Call Restriction Bypass](https://agentprime.io/advisories/CVE-2025-71281.md)
  `CVE-2025-71281` · CVE record: XenForo XenForo · CVSS 8.7 High · Not analysed yet · Published 1 Apr 2026 · Tags: Code injection
- [XenForo Local Account Page Caching Information Disclosure](https://agentprime.io/advisories/CVE-2025-71280.md)
  `CVE-2025-71280` · CVE record: XenForo XenForo · CVSS 6.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Information disclosure
- [XenForo Passkey Security Bypass](https://agentprime.io/advisories/CVE-2025-71279.md)
  `CVE-2025-71279` · CVE record: XenForo XenForo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Apr 2026 · Tags: Authentication bypass
- [XenForo OAuth2 Unauthorized Scope Request](https://agentprime.io/advisories/CVE-2025-71278.md)
  `CVE-2025-71278` · CVE record: XenForo XenForo · CVSS 8.7 High · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control
- [XenForo Open Redirect via getDynamicRedirect](https://agentprime.io/advisories/CVE-2024-58342.md)
  `CVE-2024-58342` · CVE record: XenForo XenForo · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Open redirect
- [Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories](https://agentprime.io/advisories/CVE-2023-53904.md)
  `CVE-2023-53904` · CVE record: Xenforo Xenforo · CVSS 5.1 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=xenforo>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/xenforo/>. Everything for agents: <https://agentprime.io/llms.txt>.