CVE-2026-35057: XenForo Stored Cross-Site Scripting via Structured Text Mentions

Q: What is the severity of CVE-2026-35057?

The severity of CVE-2026-35057 is rated as high due to its potential to enable stored cross-site scripting attacks.

Q: How do I fix CVE-2026-35057?

To fix CVE-2026-35057, upgrade to XenForo version 2.3.10 or 2.2.19 or later.

Q: What kind of attack does CVE-2026-35057 enable?

CVE-2026-35057 enables stored cross-site scripting (XSS) attacks through crafted structured text mentions.

Q: Which versions of XenForo are affected by CVE-2026-35057?

CVE-2026-35057 affects XenForo versions prior to 2.3.10 and 2.2.19.

Q: What is the main impact of CVE-2026-35057?

The main impact of CVE-2026-35057 is the potential for attackers to inject and execute malicious scripts in user contexts.

Published Apr 1, 2026

Updated

XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.

Affected Software

3 affected components

XenForo Xenforo<2.3.10, <2.2.19

XenForo Xenforo<2.2.19

XenForo Xenforo>=2.3.0<2.3.10

Event History

Apr 1, 2026

CVE Published

via MITRE·12:30 AM

Data Sourced

via MITRE·12:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-35057?

The severity of CVE-2026-35057 is rated as high due to its potential to enable stored cross-site scripting attacks.

How do I fix CVE-2026-35057?

To fix CVE-2026-35057, upgrade to XenForo version 2.3.10 or 2.2.19 or later.

What kind of attack does CVE-2026-35057 enable?