CVE-2026-35057 - Vulnerability Analysis

Overview

XenForo < 2.3.10 and < 2.2.19 contains a stored XSS caused by crafted structured text mentions in legacy profile post content, letting attackers inject malicious scripts executed by other users, exploit requires crafted mentions.

Severity & Score

Impact

Attackers can execute malicious scripts in other users' browsers, potentially stealing data or performing actions on their behalf.

Mitigation

Update to version 2.3.10 or 2.2.19 or later.

References

• https://github.com/methosiea/xenforo-2-xss
• https://www.vulncheck.com/advisories/xenforo-stored-cross-site-scripting-via-structured-text-mentions
• https://xenforo.com/community/threads/xenforo-2-3-10-add-ons-and-2-2-19-released-includes-security-fix.236249/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner