A flaw in XenForo allows attackers to embed malicious scripts that run when a user opens a post image or media in a lightbox. The vulnerability is a classic stored cross‑site scripting (CWE‑79) that can lead to cookie theft, session hijacking, or malicious redirection. It does not provide direct code execution on the server, but it can compromise any site visitor’s browser context while interacting with the vulnerable posts.

Users running XenForo editions prior to 2.3.9 and XenForo 2.2.18 are affected. The issue specifically involves the lightbox feature used to display images or media embedded in forum posts. Any forum or community site that has not applied newer patches is at risk.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog, implying no widely known active exploits yet. The attack requires an attacker to post malicious content or otherwise influence post media; once a victim opens the lightbox, the injected script executes. This makes it relatively easy to exploit in an environment where user‑generated content is displayed.