Xenforo CVE-2026-35057

The CVSS vector indicates network-based remote attack (AV:N) with low complexity (AC:L), requiring login (PR:L) and user interaction (UI:P) to trigger. The impact is limited to scope changes and minor integrity violations (SC:L/SI:L) with no confidentiality or availability impact, resulting in a CVSS score of 5.1. The presence of publicly available exploit code (referenced GitHub repository) elevates practical exploitation likelihood despite the moderate base score. The requirement for authenticated access and user interaction (viewing the malicious post) reduces the attack surface compared to unauthenticated or zero-click XSS variants. The vulnerability affects legacy profile post functionality, potentially limiting scope to communities actively using that feature. While not confirmed as actively exploited by CISA KEV status, the combination of public POC availability and moderate CVSS warrants prioritized patching, particularly for public-facing XenForo installations with user communities.

An authenticated attacker (user account on the target XenForo forum) crafts a malicious profile post containing a specially-formatted mention that bypasses input sanitization, injecting JavaScript code such as session cookie theft or account hijacking scripts. When other forum members visit the attacker's profile or view profile post content in community feeds, the stored malicious script executes in their browsers with the permissions of the XenForo application, potentially compromising their sessions or performing actions on their behalf. Publicly available exploit code (as identified in the referenced GitHub repository) lowers the barrier to execution, enabling attackers without advanced security research skills to implement this attack against vulnerable installations.