Description
MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MyBB | MyBB Like Plugin | 3.0.0 | — |
References
- ExploitDB-45179 exploit
- Product Reference product
- VulnCheck Advisory: MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles third-party-advisory