XenForo Stored Cross-Site Scripting Vulnerability in Structured Text Mentions

A stored cross-site scripting vulnerability has been identified in XenForo versions prior to 2.3.10 and 2.2.19. This issue primarily affects legacy profile post content, allowing attackers to inject malicious scripts through crafted mentions. These scripts are executed when other users view the content.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.

Reproduction

The vulnerability can be reproduced by injecting a script into a mention that includes placeholder-matching bytes. This can be done by using a username that, when mentioned, will trigger the XSS payload to be executed. The injected script will run when the mention is viewed by other users.

Remediation

Users are advised to upgrade to XenForo versions 2.3.10 or 2.2.19. Instructions for upgrading are available on the XenForo website.