CVE-2026-35055: XenForo Cross-Site Scripting via Lightbox in Posts
XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35055?
CVE-2026-35055 is a critical vulnerability that involves cross-site scripting (XSS) due to improper handling of lightbox usage in XenForo.
How do I fix CVE-2026-35055?
To fix CVE-2026-35055, upgrade XenForo to version 2.3.9 or 2.2.18 or later.
What versions of XenForo are affected by CVE-2026-35055?
CVE-2026-35055 affects XenForo versions prior to 2.3.9 and 2.2.18.
What can an attacker do with CVE-2026-35055?
An attacker can exploit CVE-2026-35055 to inject malicious scripts that execute in the user's browser when they interact with post content in the lightbox.
What are the consequences of exploitation of CVE-2026-35055?
Exploitation of CVE-2026-35055 can lead to unauthorized access to sensitive user data, session hijacking, or redirecting users to malicious sites.