CVE-2018-14575

HIGH

Trash Bin plugin 1.1.3 for MyBB - XSS/CSRF

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-14575. PoCs published by 0xB9.

AI-analyzed exploit summary This exploit demonstrates XSS and CSRF vulnerabilities in the MyBB Trash Bin Plugin 1.1.3. The XSS is triggered via thread/post subjects in the trash bin, while the CSRF allows unauthorized restoration of deleted threads/posts.

Description

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.

Exploits (1)

exploitdb WORKING POC
by 0xB9 · textwebappsphp
https://www.exploit-db.com/exploits/46384

This exploit demonstrates XSS and CSRF vulnerabilities in the MyBB Trash Bin Plugin 1.1.3. The XSS is triggered via thread/post subjects in the trash bin, while the CSRF allows unauthorized restoration of deleted threads/posts.

Classification
Working Poc 90%
Attack Type
Xss | Csrf
Complexity
Trivial
Reliability
Reliable
Target: MyBB Trash Bin Plugin 1.1.3
Auth required
Prerequisites: Access to MyBB admin panel · Ability to create/delete threads/posts
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.exploit-db.com/exploits/46384/
Release Notes, Vendor Advisory x_refsource_misc
https://community.mybb.com/mods.php?action=view&pid=957

Scores

CVSS v3 8.8
EPSS 0.0238
EPSS Percentile 81.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352 CWE-79
Status published
Products (1)
mybb/trash_bin 1.1.3
Published Mar 21, 2019
Tracked Since Feb 18, 2026