CVE-2026-73319 PUBLISHED

XenForo < 2.3.13 XSS via Dynamic Redirect Handler

Assigner: VulnCheck
Reserved: 11.08.2026 Published: 08.09.2026 Updated: 09.09.2026

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.1

Product Status

Vendor XenForo
Product XenForo
Versions Default: unaffected
  • affected from 0 to 2.3.13 (excl.)

Credits

  • Marco Paciaroni (BomboBombone) finder
  • VulnCheck coordinator

References

Problem Types

  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE