Xenforo CVE-2026-35054

The CVSS v4.0 score of 5.1 reflects a low-severity impact profile: the vulnerability has scope changes limited to the security layer (SC:L), causes low integrity and confidentiality impacts, and requires prior authentication (PR:L) with user interaction (UI:P). However, the real-world risk is higher than the base score suggests due to the stored nature of the XSS. While individual exploits require user interaction to view malicious content, the persistent storage means every future viewer of a compromised post becomes a potential target. The network attack vector (AV:N) and low complexity (AC:L) make the initial injection trivial once authenticated. CVSS does not fully capture the reputational damage to a forum community or the potential for lateral attacks through session tokens of viewed users. Exploitation probability is moderate: the vulnerability requires authentication but not high privileges, making it exploitable by regular forum members, though the user-interaction requirement delays impact. No public exploit or CISA KEV status is indicated in the provided data, suggesting limited external validation at time of analysis, though the straightforward nature of BB code injection likely makes exploitation straightforward for skilled attackers. The primary concern is persistent harm across user sessions rather than immediate system compromise.

A malicious forum member crafts a post containing specially formatted BB code that includes embedded JavaScript, such as within an [url], [img], or custom BB code tag. When the post is submitted and stored in the database, the injected script is not properly sanitized. Subsequent viewers of the post (including administrators or other users) load the malicious content, triggering the stored XSS payload in their browsers. The attacker can then steal session cookies, redirect users to phishing sites, or perform actions on behalf of the victim account. No public proof-of-concept exploit has been identified at time of analysis, but the attack requires only normal forum participation and leverages a predictable code injection pattern.