CVE-2026-35057 in XenForo
摘要 (英语)
XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.
负责
VulnCheck
预定
2026-04-01
披露
2026-04-01
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354561 | XenForo Mentions 跨网站脚本 | 79 | 未定义 | 官方修复 | CVE-2026-35057 |