X
Vendor security profile
XenForo
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical3
CISA KEV0
Public exploit14
Patch rate%100
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
14
0
CVE KEV
CVE severity distribution
14toplam CVE
Critical3 (21%)
High7 (50%)
Medium4 (29%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%100
Public exploit
14Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
8.6
CVE-2026-74239
XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
X
Patch verifiedEPSS %1
7.1
CVE-2026-73321
XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
X
Patch verifiedEPSS %1
5.1
CVE-2026-73320
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
X
Patch verifiedEPSS %0
5.1
CVE-2026-73319
XenForo < 2.3.13 XSS via Dynamic Redirect Handler
X
Patch verifiedEPSS %0
5.1
CVE-2026-73318
XenForo < 2.3.13 Missing Authorization via force-agreement Controller
X
Patch verifiedEPSS %0
5.1
CVE-2026-73317
XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
X
Patch verifiedEPSS %0
8.7
CVE-2026-73316
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
X
Patch verifiedEPSS %0
7.7
CVE-2026-73315
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
X
Patch verifiedEPSS %0
8.7
CVE-2026-73314
XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
X
Patch verifiedEPSS %1
7.6
CVE-2026-73313
XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
X
Patch verifiedEPSS %1