MyBB Trending Widget Plugin Cross-Site Scripting Vulnerability
Vulnerability
A cross-site scripting (XSS) vulnerability has been identified in the MyBB Trending Widget Plugin version 1.2. This issue allows attackers to inject malicious scripts into thread titles, which are then executed when other users view the trending widget.
Impact
Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.
Reproduction
To reproduce this vulnerability, first ensure that the MyBB Trending Widget Plugin version 1.2 is installed and active. Next, create a trending thread and modify its title to include a script payload, such as a JavaScript alert. Once the title is saved, the injected script will execute when other users view the trending widget.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.