PatchTheCVExenforo vulnerabilities
Recent CVEs affecting xenforo products. 14 tracked.
xenforo has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-09-08. Highest priority: CVE-2026-73309 (score 49/100).
- CVE-2026-73318 LOW 3.8 UPGRADE XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that al
- CVE-2026-73313 MEDIUM 6.8 UPGRADE XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider
- CVE-2026-73310 MEDIUM 5.9 UPGRADE XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers contro
- CVE-2026-73309 HIGH 7.4 UPGRADE XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows
- CVE-2026-73316 HIGH 7.5 UPGRADE XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows
- CVE-2026-73315 HIGH 8.6 UPGRADE XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler
- CVE-2026-73314 HIGH 7.5 UPGRADE XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that al
- CVE-2026-73312 HIGH 7.4 UPGRADE XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh t
- CVE-2026-73311 HIGH 7.4 UPGRADE XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtai
- CVE-2026-74239 HIGH 7.2 UPGRADE XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deploym
- CVE-2026-73321 MEDIUM 6.5 UPGRADE XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authen
- CVE-2026-73320 MEDIUM 6.1 UPGRADE XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthentic
- CVE-2026-73319 MEDIUM 6.1 UPGRADE XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allow
- CVE-2026-73317 LOW 2.7 UPGRADE XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that
FAQ
How do I fix xenforo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xenforo being exploited right now?
None of the tracked xenforo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xenforo CVE should I patch first?
CVE-2026-73309 currently ranks highest (49/100): XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows.