CVE-2026-43939

YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.

Affected

YAFNET

CVSS v3.1 GITHUB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2026-05-12

Updated

2026-05-13

Proof-of-concept exploits (1)

• advisories/GHSA-8rq5-wwpp-fmj2

References

• CVE Record
• NVD entry