CVE-2026-35055 in XenForo

Sumário (Inglês)

XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsável

VulnCheck

Reservar

01/04/2026

Divulgação

01/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354526	XenForo Script de Site Cruzado	79	Não definido	Correção oficial	CVE-2026-35055

Fontes

• MITRE
• NVD
• CVE Details