EUVD-2026-17741Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.
AnalysisAI
Cross-site scripting (XSS) in XenForo lightbox functionality allows unauthenticated remote attackers to inject malicious scripts that execute in the context of other users' browsers when interacting with post content displayed via lightbox. Versions before 2.3.9 and 2.2.18 are affected. The vulnerability requires user interaction (clicking or hovering on lightbox elements) and has limited scope, affecting only session integrity and information disclosure rather than system availability or confidentiality of sensitive data.
Technical ContextAI
XenForo is a web-based forum platform that includes a lightbox feature for displaying images and media within posts. The vulnerability stems from improper input sanitization or output encoding in the lightbox component, allowing attacker-controlled content to be rendered as executable JavaScript. This is a classic Stored or Reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-supplied data in post content is not properly escaped before being inserted into the Document Object Model (DOM) within the lightbox rendering context. The affected product is identified by CPE a:xenforo:xenforo covering all versions below the patched releases.
RemediationAI
Immediately upgrade to XenForo 2.3.9 or later if running a 2.3.x version, or to 2.2.18 or later if running a 2.2.x version. Both releases include security fixes for the lightbox XSS vulnerability. Users unable to upgrade immediately should restrict access to lightbox functionality or disable it via configuration until patching is feasible. Review post content for any suspicious scripts or payloads that may have been injected prior to patching. Consider implementing a Web Application Firewall (WAF) rule to detect and block XSS payloads in post submissions as a temporary mitigation. Complete remediation details and download links are available in the official advisory at https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today