XenForo Cross-Site Scripting Vulnerability via Lightbox in Posts

A cross-site scripting (XSS) vulnerability has been identified in XenForo versions prior to 2.3.9 and prior to 2.2.18. The issue arises from lightbox usage in posts, allowing attackers to inject malicious scripts that execute when users interact with the affected post content.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users can upgrade to XenForo 2.3.9 or 2.2.18, both of which include the necessary security fix. For those on XenForo 2.3.7 or earlier, a specific patch is available. Instructions for applying the patch or upgrading are provided in the XenForo release announcement.