CVE-2025-71281: Xenforo

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.

Affected products

• Xenforo Xenforo: before 2.3.7 (fixed in 2.3.7)

Published 2026-04-01. Last modified 2026-06-17.