CVE-2021-43032

4.8 mediumEPSS 0.9%

Medium (4.8) in xenforo xenforo. EPSS 0.9% chance of exploitation in the next 30 days.

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-11-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xenforo:xenforo

References

https://github.com/SakuraSamuraii/CVE-2021-43032
https://xenforo.com/community/forums/announcements/
https://github.com/SakuraSamuraii/CVE-2021-43032
https://xenforo.com/community/forums/announcements/

Check your stack JSON