This vulnerability is a stored cross-site scripting flaw residing in structured text mentions of XenForo versions prior to 2.3.10 and 2.2.19. An attacker can embed malicious script code into a mention that is then saved to the database. When other users view the content, the script executes in their browsers, potentially allowing an attacker to steal session data, deface pages, or perform other client‑side attacks. The weakness is classified as CWE‑79.

The affected software is XenForo, specifically any releases older than 2.3.10 and older than 2.2.19. Users running those legacy versions are susceptible to the flaw.

The CVSS score of 5.1 indicates a medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at present. The attack vector is likely any user who can post structured text content; by inserting a crafted mention with embedded script, the attacker can compromise any other user who views the posts. The exploitation requires access to write or edit profile post content, which may be limited to registered users or administrators.