CVE-2018-25250

HIGH

MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS

Title source: cna
STIX 2.1

Description

MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by crafting thread subjects with script tags. Attackers can create threads with script payloads in the subject field that execute when users visit the attacker's profile page.

Exploits (1)

exploitdb WORKING POC
by 0xB9 · textwebappsphp
https://www.exploit-db.com/exploits/44339

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-44339
https://www.exploit-db.com/exploits/44339
Third Party Advisory third-party-advisory
VulnCheck Advisory: MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS
https://www.vulncheck.com/advisories/mybb-last-user-s-threads-in-profile-plugin-persistent-xss

Scores

CVSS v3 7.2
EPSS 0.0003
EPSS Percentile 6.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
mybb/last_user_threads < 1.2
MyBB/MyBB Last User's Threads in Profile Plugin 1.2
Published Apr 04, 2026
Tracked Since Apr 04, 2026