CVE-2026-35057 — XenForo Stored Cross-Site Scripting via Structured Text Mentions
XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attac…
Published: 2026-04-01 · CVSS: 5.1 · CVSS 4.0
XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7