CVE-2023-53976

myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management

State: Published
Severity: 5.1 Medium
Published: Dec 22, 2025
Updated: Apr 7, 2026
Reserved: Dec 20, 2025

Description

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject malicious scripts when creating new templates. Attackers can exploit this vulnerability by inserting script payloads in the template title field when adding new templates through the 'Templates and Style' > 'Templates' > 'Manage Templates' > 'Global Templates' interface, causing arbitrary JavaScript to execute when the template is viewed.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
myBB forumsMybb	1.8.26Affected

References

ExploitDB-51136exploit
Official myBB Software Version Pageproduct
VulnCheck Advisory: myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Managementthird-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-41866

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.