nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-53904 CVE-2023-53904
MEDIUM
Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories
Record summary
CVE-2023-53904 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie category title parameter. Attackers can create a smilie category with a malicious script that will execute when the admin panel is loaded, potentially enabling further client-side attacks.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 18, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
XenforoBrowse Xenforo / Xenforo | CVE List | 2.2.13 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBXenforo Version 2.2.13 - Authenticated Stored XSSExploitDB exploitby Furkan KaraarslanNot analyzed1 file
References
4ExploitDB-51547exploit
https://www.exploit-db.com/exploits/51547 VulnCheck Advisory: Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie CategoriesThird-party advisory
https://www.vulncheck.com/advisories/xenforo-authenticated-stored-cross-site-scripting-via-smilie-categories Official Product Webpageproduct
https://xenforo.com/