Cross-Site Scripting Vulnerability in XenForo by XenForo Limited
CVE-2026-73319

5.1MEDIUM

Key Information:

Vendor

Xen Projectforo

Status
Xen Projectforo
Vendor
CVE Published:
8 September 2026

What is CVE-2026-73319?

XenForo versions prior to 2.3.13 contain a cross-site scripting flaw in the dynamic redirect handler. This vulnerability enables unauthenticated attackers to execute arbitrary JavaScript on the website, potentially compromising user sessions. By crafting a malicious javascript: URI that evades host validation, attackers can exploit the flaw. They leverage percent-encoded newlines to bypass server-side filters, leading to situations where authenticated users inadvertently execute attacker-supplied scripts. It is crucial for users of affected versions to apply the latest security updates to mitigate this risk.

Affected Version(s)

XenForo 0 < 2.3.13

References

https://xenforo.com/community/threads/security-fixes-rele...
vendor-advisorypatch
https://xenforo.com/community/threads/xenforo-2-3-13-and-...
release-notes
https://www.vulncheck.com/advisories/xenforo-xss-via-dyna...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Paciaroni (BomboBombone)
VulnCheck
.