CVE-2026-73319

XenForo versions before 2.3.13 contain a cross-site scripting flaw (CWE-79) in the dynamic redirect handler, where host validation of redirect URIs can be bypassed. An unauthenticated attacker crafts a javascript: URI that embeds the board's own hostname in the URI authority component and uses percent-encoded newlines to evade the server-side filters, then induces an authenticated user to trigger it via the Follow action. On success, attacker-supplied JavaScript executes in the user's browser within the board's origin, which can be used for session hijacking, credential theft, or malicious actions on behalf of the victim. Any XenForo board running a version prior to 2.3.13 is affected; exploitation requires user interaction (a logged-in user clicking the crafted Follow redirect). There are no confirmed in-the-wild exploits at this time; a public proof-of-concept exists and EPSS puts 30-day exploitation probability at a low 0.3%.

What to do: Upgrade XenForo to version 2.3.13 or later. Until patched, review and sanitize any externally influenced redirect links (especially those using javascript: URIs) and consider validating the redirect target strictly against the board's own hostname. Admins can review board link submissions and monitor for crafted Follow redirects referencing the PoC.