Description
XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| XenForo | XenForo | 2.3.0 – < 2.3.9 | 2.3.9 |
References
- XenForo 2.3.9 (inc XFMG) & 2.2.18 Released (Security Fix) vendor-advisory patch
- VulnCheck Advisory: XenForo Stored Cross-Site Scripting via BB Code Rendering third-party-advisory