CVE-2026-35054
Stored XSS in XenForo BB Code Allows Script Injection
Publication date: 2026-04-01
Last updated on: 2026-04-01
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xenforo | xenforo | to 2.3.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious scripts via BB code, which execute when other users view the content.
Such vulnerabilities can potentially lead to unauthorized access to user data or session hijacking, which may impact the confidentiality and integrity of personal information.
This could affect compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal data against unauthorized access or disclosure.
However, the provided context and resources do not explicitly discuss the impact of this vulnerability on compliance with these standards or regulations.
Can you explain this vulnerability to me?
CVE-2026-35054 is a stored cross-site scripting (XSS) vulnerability in XenForo versions before 2.3.9. It occurs due to improper handling of BB code rendering, allowing an attacker to inject malicious scripts through BB code. These scripts are stored on the server and executed when other users view the affected content.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the browsers of users who view the infected content. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the victim user.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored cross-site scripting (XSS) through BB code rendering in XenForo versions prior to 2.3.9. Detection typically involves identifying malicious BB code injections in user-generated content.
There are no specific commands provided in the available resources to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade your XenForo installation to version 2.3.9 or later, which includes fixes for the stored XSS vulnerability related to BB code rendering.
If upgrading is not immediately possible, apply the official patch (239-patch.zip) by downloading, extracting, and uploading it to the root of your XenForo installation, then rebuild master data via the admin interface or command line using the command `xf:rebuild-master-data`.
Note that applying patches will cause the "File health check" to report "Unexpected contents," which is expected and safe to ignore.
For XenForo Cloud customers, these fixes have been automatically applied and no further action is required.