Vulnerabilities in Xenforo
25 resultsCVE-2026-74239HIGHXenForo < 2.3.13 Path Traversal via Style Archive Importer on WindowsEPSS 0.9%CVE-2026-73309CRITICALXenForo < 2.3.13 Authentication Bypass via OAuth2 Token EndpointEPSS 0.7%CVE-2026-35056HIGHXenForo Remote Code Execution via Authenticated AdminEPSS 0.7%CVE-2026-73314HIGHXenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookEPSS 0.7%CVE-2026-73321HIGHXenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode ParserEPSS 0.6%CVE-2026-73313HIGHXenForo < 2.3.13 MFA Bypass via Passkey TFA ProviderEPSS 0.6%CVE-2026-73311CRITICALXenForo < 2.3.13 OAuth2 Authorization Code ReuseEPSS 0.5%CVE-2026-73318MEDIUMXenForo < 2.3.13 Missing Authorization via force-agreement ControllerEPSS 0.5%CVE-2026-73310HIGHXenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri BypassEPSS 0.5%CVE-2026-73312CRITICALXenForo < 2.3.13 Refresh Token Replay via Expired Access TokenEPSS 0.5%CVE-2025-71279CRITICALXenForo Passkey Security BypassEPSS 0.5%CVE-2026-73319MEDIUMXenForo < 2.3.13 XSS via Dynamic Redirect HandlerEPSS 0.4%CVE-2026-73317MEDIUMXenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild DispatcherEPSS 0.4%CVE-2026-73320MEDIUMXenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl EndpointEPSS 0.4%CVE-2026-73315HIGHXenForo < 2.3.13 SSRF via PayPal REST Webhook HandlerEPSS 0.4%CVE-2025-71282HIGHXenForo Path Disclosure via open_basedir ExceptionsEPSS 0.3%CVE-2025-71281HIGHXenForo Template Method Call Restriction BypassEPSS 0.3%CVE-2025-71278HIGHXenForo OAuth2 Unauthorized Scope RequestEPSS 0.3%CVE-2023-53904MEDIUMXenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie CategoriesEPSS 0.3%CVE-2026-73316HIGHXenForo < 2.3.13 Payment Replay via PayPal REST Payment ProviderEPSS 0.3%