Description
XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| XenForo | XenForo | 2.3.0 – < 2.3.9, < 2.2.18 | 2.3.9 |
References
- XenForo 2.3.9 (inc XFMG) & 2.2.18 Released (Security Fix) vendor-advisory patch
- VulnCheck Advisory: XenForo Cross-Site Scripting via Lightbox in Posts third-party-advisory