CVE-2023-53904: Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories

Published Dec 17, 2025

Updated

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie category title parameter. Attackers can create a smilie category with a malicious script that will execute when the admin panel is loaded, potentially enabling further client-side attacks.

Affected Software

1 affected component

XenForo Xenforo

Event History

Dec 17, 2025

CVE Published

via MITRE·10:44 PM

Data Sourced

via MITRE·10:44 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-53904?

CVE-2023-53904 is considered a high-severity vulnerability due to its potential impact on authenticated administrators.

How do I fix CVE-2023-53904?

To fix CVE-2023-53904, update your Xenforo installation to version 2.2.14 or later.

Who is affected by CVE-2023-53904?

Authenticated administrators using Xenforo versions prior to 2.2.14 are affected by CVE-2023-53904.

What type of vulnerability is CVE-2023-53904?

CVE-2023-53904 is categorized as a stored cross-site scripting (XSS) vulnerability.

Can CVE-2023-53904 be exploited remotely?

CVE-2023-53904 requires authenticated access, meaning it cannot be exploited remotely without valid administrator credentials.