VYPR
← All advisories
Medium severity6.4NVD Advisory· Published Apr 1, 2026· Updated Apr 1, 2026

CVE-2026-35057

CVE-2026-35057

Description

XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Xenforo/Xenforo2 versions
    cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*range: <2.2.19
    • (no CPE)range: <2.3.10 and <2.2.19

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.