EIP-2026-113000

The advisory details a persistent XSS vulnerability in vBulletin 4.0.8 via the Profile Customization feature, where insufficient input sanitization allows script injection through CSS functions like url(). It includes proof-of-concept payloads for both private and global XSS scenarios.