MyBB Thread Redirect Plugin Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in the MyBB Thread Redirect Plugin version 0.2.1. The issue arises in the custom text input field for thread redirects, where attackers can inject malicious SVG scripts. These scripts are executed when other users view the thread, potentially allowing for arbitrary script execution.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user viewing the thread.

Reproduction

To reproduce this vulnerability, create a new thread and enter any subject and redirect URL. In the message field, input a payload such as a SVG image with an 'onload' event. When the thread is viewed, the injected script will execute, demonstrating the cross-site scripting vulnerability.