EIP-2026-109715

This exploit demonstrates a stored XSS vulnerability in MyBB 1.8.2 by injecting malicious JavaScript into the 'Custom User Title' field, which executes when viewed in the calendar event page. The PoC includes detailed HTTP request/response examples and step-by-step reproduction instructions.