XenForo before version 2.3.9 allows an attacker to embed malicious scripts into posts by using BB code. The scripts are stored in the database and are executed whenever another user views the content, creating a stored cross‑site scripting (XSS) vulnerability identified as CWE‑79. This flaw can enable cookie theft, forum defacement, or redirection to malicious sites, affecting all users who view the compromised posts.

The vulnerability impacts all installations of XenForo running any version prior to 2.3.9 that have BB code rendering enabled for user posts. The affected product is XenForo’s forum platform, and any instance that permits user‑generated BB code is potentially vulnerable. No specific sub‑version details beyond the 2.3.9 cutoff are listed.

The CVSS score of 5.1 indicates a medium severity level. With no EPSS score available and the vulnerability not listed in the CISA KEV catalog, current exploitation is plausible but not yet widespread. The attack path is inferred to involve an attacker submitting a post containing malicious BB code; any visitor to the post will trigger the stored XSS. No authentication prerequisites are mentioned, implying that anyone who can post with BB code can potentially exploit the system. Until the issue is patched, the risk remains moderate, especially in high‑traffic forums where many users may be exposed to the compromised content.