Executive brief
A vulnerability exists in a MyBB forum plugin that displays a user's recent posts on their profile page. An attacker can create a forum post with a malicious title that, when viewed by other users or administrators on the attacker's profile, executes unauthorized code in their browser. This could lead to the theft of login sessions, unauthorized actions on behalf of users, or the defacement of profile pages.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in the MyBB 'Last User's Threads in Profile' plugin version 1.2. The root cause is improper neutralization of input in the thread subject field (CWE-79). An attacker can exploit this by creating a new forum thread with a subject containing malicious JavaScript tags. When any user, including administrators, visits the attacker's profile page, the plugin renders the thread subject without proper sanitization, causing the script to execute in the victim's browser context. This can be used to hijack sessions or perform unauthorized actions. A patch is available via a GitHub commit to the plugin repository.
Affected products
- MyBB Last User's Threads in Profile Plugin 1.2
Timeline
- 2018-03-19: disclosed: Vulnerability discovered and reported by 0xB9
- 2018-03-23: other: Exploit published on Exploit-DB
- 2026-04-04: advisory: NVD/VulnCheck advisory published