CVE-2021-43032: Xenforo

Medium severity, CVSS 4.8. EPSS: 0.9% chance of exploitation in the next 30 days.

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.

Affected products

• Xenforo Xenforo: up to and including 2.2.7

Published 2021-11-03. Last modified 2026-06-17.