XenForo Announcements

During routine internal testing, we discovered a security issue within XenForo 1.3 and newer. The issue allows a cross site scripting (XSS) attack to potentially be triggered via a specially crafted profile post. XSS issues may allow an attacker to steal data (including cookies) or force a user to take actions without their consent or knowledge (possibly including administrative actions). We strongly recommend all XenForo customers follow one of the steps below to resolve this issue. If you have any questions relating to installing this patch or upgrading to the new version, please post in the Upgrade Support forum. Method 1: Upgrade to the New Version (Recommended) You may upgrade to XenForo 1.4.12 (or the latest version of 1.5) to...

During routine internal testing, we discovered a security issue within XenForo 1.3 and newer. The issue allows a cross site scripting (XSS) attack to potentially be triggered via a specially crafted profile post. XSS issues may allow an attacker to steal data (including cookies) or force a user to take actions without their consent or knowledge (possibly including administrative actions). We strongly recommend all XenForo customers follow one of the steps below to resolve this issue. If you have any questions relating to installing this patch or upgrading to the new version, please post in the Upgrade Support forum. Method 1: Upgrade to the New Version (Recommended) You may upgrade to XenForo 1.3.10 (or the latest versions of 1.4 or...

Today, we are pleased to release XenForo 1.5.3. This release fixes a number of bugs and issues that were found since the release of 1.5.2. As this is a maintenance release, the vast majority of the focus was an increase in stability. Please note that we are now formally recommending that you upgrade to PHP 5.4 or newer. Our intention with XenForo 2.0 is to require PHP 5.4 or newer. If you are running PHP 5.3 or 5.2, you will receive a warning when installing or upgrading XenForo. Add-on developers: there are some serialization compatibility changes in 1.5.3. Please see this thread for details as you may need to check your add-ons or make changes. Some of the bugs fixed in 1.5.3 include: Add beta importers for IPB 4.0/4.1 and phpBB...

XenForo Resource Manager 1.2.2 is a maintenance release for our resource manager add-on. We recommend all customers running XenForo Resource Manager 1.2 upgrade to 1.2.2 to benefit from increased stability. This release fixes one bug: Fix an issue where, when editing, more attachments could be added to a resource than should have been allowed. For the full list of bug fixes, see the Resolved Resource Manager Bugs forum. XenForo Resource Manager 1.2 requires XenForo 1.5.0 or later. Customers with the appropriate license may download XenForo Resource Manager via their customer area. Download XenForo Resource Manager 1.2.2 From the Licensed Customer Area Purchasing The XenForo Resource Manager can be purchased with a new license...

XenForo Enhanced Search (XFES) 1.1.3 is a maintenance release for our add-on that replaces XenForo's built in search engine with one powered by Elasticsearch to provide greater performance and better search results. This release fixes several bugs: Remove the default stopwords list as it is not applied in many cases. Fix incompatibility with Elasticsearch 2.0 when loading a script for scoring. Fix incompatibility with Elasticsearch 2.0 when limiting user searches to a max date. Improve error logging in Elasticsearch 2.0. Fix inconsistently handling of database names as index names if the database name contained uppercase characters. Requirements XFES requires that you have elasticsearch 0.16.0 or newer installed. As such, this...

We have recently become aware of a security issue within XenForo and have released a patch and new version (XenForo 1.3.9) to resolve this issue. We strongly recommend all XenForo customers follow the steps below to resolve this issue. The issue was discovered by Miguel Ángel Jimeno (@migueljimeno96). It employs a tactic known as "reverse tabnabbing" in which a link that opens in a new tab contains code that can redirect the original tab to another URL, which could be used as a phishing attempt. If you have any questions relating to installing this patch or upgrading to the new version, please post in the Upgrade Support forum. Method 1: Upgrade to the New Version You may upgrade to XenForo 1.3.9 to fix this issue. You should...

Today, we are pleased to release XenForo 1.5.2. This release fixes a number of bugs and issues that were found since the release of 1.5.1. Importantly, this release includes a fix for a potential security issue discovered by Miguel Ángel Jimeno (@migueljimeno96). The issue employs a tactic known as "reverse tabnabbing" in which a link that opens in a new tab contains code that can redirect the original tab to another URL, which could be used as a phishing attempt. We strongly recommend all customers follow one of the below methods to fix this security issue. Method 1: Upgrade to the New Version You may upgrade to XenForo 1.5.2 to fix this issue. You should upgrade as you would to any other release. See further below in this...