MyBB Delete Account Plugin Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the MyBB Delete Account Plugin version 1.4. The issue arises in the account deletion reason input field, where attackers can inject malicious scripts. These scripts are executed in the admin interface when delete account reasons are viewed.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user viewing the delete account reasons in the admin interface.

Reproduction

To reproduce this vulnerability, navigate to the User Control Panel and select the option to delete an account. In the account deletion reason field, enter a script payload, such as a JavaScript alert. Once submitted, the injected script will execute when the admin views the delete account reasons.