Today, we are releasing XenForo 2.1.12 to address two potential security vulnerabilities. We strongly recommend that all customers running XenForo 2.1 upgrade to 2.1.12 or use the attached patch file as soon as possible.
The issues are XSS vulnerabilities. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.
XenForo extends thanks to security researcher Vincent ibn Winnie for reporting the issues.
We recommend doing a full upgrade to resolve the issues, but a patch can be applied manually. See below for further details.
If you are currently running 2.1, the automatic upgrade check will now allow you to upgrade to 2.1.12 within your control panel. Once you are running the latest 2.1 release, it will report that an upgrade to 2.2 is available. If you would like to upgrade to 2.1.12 and the control panel reports that 2.2.0 is available, you may manually check for upgrades via Tools > Check for upgrades.
Please be aware that XenForo 2.0 is no longer supported or receiving security updates. We strongly recommend that customers running 2.0 upgrade to the current version.
