CVE-2018-25132
MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jan 23, 2026
- Updated
- Jan 23, 2026
- Reserved
- Dec 24, 2025
Description
MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attackers can modify thread titles with script payloads that will execute when other users view the trending widget.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
MyBB Trending Widget Pluginzainali99 |
|
References
- ExploitDB-49504exploit
- Trending Widget GitHub Repositoryproduct
- VulnCheck Advisory: MyBB Trending Widget Plugin 1.2 - Cross-Site Scriptingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.