MyBB Recent Threads Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in the MyBB Recent Threads plugin version 17.0. This vulnerability allows attackers to inject malicious scripts by creating threads with specially crafted subject lines. The injected scripts are executed as arbitrary JavaScript in the browsers of users viewing the index page.

Impact

Exploitation of this vulnerability leads to persistent cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, create a thread with a subject line that includes script tags, such as a JavaScript alert. Once the thread is created, navigate to the index page to observe the script execution, which will manifest as an alert box displaying the message.