What’s Vulnerable › Vulnerabilities

CVE-2026-35055: XenForo Cross-Site Scripting via Lightbox in Posts

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-01 · updated 2026-06-17
• Weakness: CWE-79

Description

XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.

Affected products

• XenForo: before 2.2.18; from 2.3.0 before 2.3.9 — fixed in 2.2.18, 2.3.9

How to fix

Upgrade to a fixed version: XenForo 2.2.18, 2.3.9. Check the vendor advisory for mitigations.

References

• https://www.vulncheck.com/advisories/xenforo-cross-site-scripting-via-lightbox-in-posts
• https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/

Get alerted when CVE-2026-35055 or the next vulnerability affects your stack