XenForo Announcements

XenForo 2.1.10 Patch 2 Released Shortly after releasing 2.1.10, we became aware of an incompatibility related to how some add-ons add custom CSS to the control panel. This could lead to the control panel appearing unstyled. In order to resolve this, we have released XenForo 2.1.10 Patch 2. You can perform the upgrade directly from your control panel by going to Tools > Check for upgrades (<url>/admin.php?tools/upgrade-check if you do not see the link due to display issues). You can also download the update from your Customer area and upgrade manually. (Note that Patch 1 was briefly released and has been superseded with Patch 2 to resolve this issue.)

XenForo 2.1.10 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability. Most importantly, this release fixes a security vulnerability in XenForo. The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access. The vulnerability requires some very specific steps to be taken, involving pasting malicious content into the XenForo rich text editor, which may mean it is difficult to trigger. XenForo extends thanks to @TickTackk for reporting the issue. While we recommend doing a full...

Today, we are releasing XenForo 2.1.9 and XenForo 2.0.13 to address a potential security vulnerability that may affect any customer who makes use of our PayPal payment handler. As well as user upgrades, this may affect add-ons you have installed which process payments using our PayPal payment handler. We recommend that all affected customers running XenForo 2.1 or XenForo 2.0 upgrade to 2.1.9 or 2.0.13 or use one of the attached patch files as soon as possible. Specifically, the issue relates to a specially crafted callback (or IPN) which is then processed successfully using PayPal's sandbox validation endpoint instead of their live system. If successful, a purchase could be completed without your PayPal account actually receiving...

XenForo 2.1.8 Patch 2 Released We have identified an issue in 2.1.8 that may cause certain template modifications in add-ons to not be applied correctly. This issue is discussed in more detail in this bug report. In order to resolve this, we have released XenForo 2.1.8 Patch 2. You can perform the upgrade directly from your control panel by going to Tools > Check for upgrades. You can also download the update from your Customer area.

We have fixed two issues in XenForo 2.1.8 which cause errors or unexpected behavior: Error relating to warning_points when rebuilding user caches Error when sending a payment receipt with user upgrades/purchasables We have released XenForo 2.1.8 Patch 1 to resolve these issues. You can perform the upgrade directly from your control panel by going to Tools > Check for upgrades. You can also download the update from your Customer area.

XenForo Enhanced Search 2.1.4 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo Enhanced Search 2.1 upgrade to this release to benefit from increased stability. Download XenForo Enhanced Search 2.1.4 or Upgrade directly from within your control panel Some of the changes in XFES 2.1.4 include: If updating index settings fails, make sure the Elasticsearch index is reopened. Update Add-on list FAQ link for the add-on to the correct version of the manual. XenForo Enhanced Search requires XenForo 2.1 or later. Purchasing XenForo Enhanced Search can be purchased with a new license via the purchase page or with an existing license via the customer area...

XenForo Resource Manager 2.1.6 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo Resource Manager 2.1 upgrade to this release to benefit from increased stability. Download XenForo Resource Manager 2.1.6 or Upgrade directly from within your control panel Some of the changes in XFRM 2.1.6 include: Remove duplicated permission check when checking viewing permissions for resources. Fixed an issue preventing reviews made by deleted members from being deleted. Update Add-on list FAQ link for the add-on to the correct version of the manual. XenForo Resource Manager requires XenForo 2.1 or later. Purchasing XenForo Resource Manager can be purchased with a new...