CVE-2026-73319

Analyzed Analyzed - Analysis Complete

XSS in XenForo via Malicious javascript: URI

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: VulnCheck

Description

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73319

Affected Vendors & Products

Vendor	Product	Version / Range
xenforo	xenforo	to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

XenForo before 2.3.13 has a cross-site scripting (XSS) flaw in its dynamic redirect handler. Attackers can craft a malicious javascript: URI that bypasses host validation by embedding the board hostname and using percent-encoded newlines to evade filters. When a logged-in user performs a Follow action, the attacker's JavaScript executes in the victim's browser within the XenForo origin.

Detection Guidance

Check XenForo version with: grep -r 'XenForo' /path/to/install | grep 'version'. If version is below 2.3.13, the system is vulnerable. Inspect network traffic for suspicious javascript: URIs in redirect handlers.

Impact Analysis

An attacker could trick you into clicking a malicious link, leading to unauthorized actions on your behalf, theft of session cookies, or defacement of the XenForo board. Since the attack executes in the board's origin, it may bypass some security measures and appear more trustworthy.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable XenForo versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade XenForo to version 2.3.13 or later immediately. Review and restrict dynamic redirect handlers to trusted URL schemes. Monitor for unusual Follow actions or unexpected JavaScript execution in user sessions.

Hi! I’m here to help you understand CVE-2026-73319. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70