{"id":"CVE-2026-35057","state":"PUBLISHED","title":"XenForo Stored Cross-Site Scripting via Structured Text Mentions","description":"XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.","publishedAt":"2026-04-01T00:30:14.682Z","updatedAt":"2026-05-24T01:37:47.991Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["XenForo XenForo"],"affected":[{"vendor":"XenForo","product":"XenForo","versions":[{"version":"2.3.0","status":"affected","lessThan":"2.3.10","versionType":"semver"},{"version":"0","status":"affected","lessThan":"2.2.19","versionType":"semver"}]}],"references":["https://xenforo.com/community/threads/xenforo-2-3-10-add-ons-and-2-2-19-released-includes-security-fix.236249/","https://github.com/methosiea/xenforo-2-xss"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/35xxx/CVE-2026-35057.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-35057","state":"PUBLISHED","datePublished":"2026-04-01T00:30:14.682Z","dateUpdated":"2026-05-24T01:37:47.991Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-04-01T00:19:59.194Z"},"containers":{"cna":{"title":"XenForo Stored Cross-Site Scripting via Structured Text Mentions","descriptions":[{"lang":"en","value":"XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content."}],"affected":[{"vendor":"XenForo","product":"XenForo","versions":[{"version":"2.3.0","status":"affected","lessThan":"2.3.10","versionType":"semver"},{"version":"0","status":"affected","lessThan":"2.2.19","versionType":"semver"}]}],"references":[{"url":"https://xenforo.com/community/threads/xenforo-2-3-10-add-ons-and-2-2-19-released-includes-security-fix.236249/","name":"XenForo 2.3.10 & Add-ons and 2.2.19 Released (Includes Security Fix)","tags":["vendor-advisory","patch"]},{"url":"https://github.com/methosiea/xenforo-2-xss","name":"XenForo 2.x Stored XSS via Placeholder Collision PoC","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-24T01:37:47.991Z"},"datePublic":"2026-03-06T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*","versionStartIncluding":"2.3.0","versionEndExcluding":"2.3.10"},{"vulnerable":true,"criteria":"cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*","versionEndExcluding":"2.2.19"}]}]}],"credits":[{"lang":"en","value":"metho","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-01T13:18:54.885969Z","id":"CVE-2026-35057","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-01T13:19:02.344Z"}}]}}}