CVE-2023-53977

myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management

State: Published
Severity: 5.1 Medium
Published: Dec 22, 2025
Updated: Apr 7, 2026
Reserved: Dec 20, 2025

Description

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when adding new forums through the 'Forums and Posts' > 'Forum Management' interface, causing arbitrary JavaScript to execute when the forum listing is viewed.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
myBB forumsMybb	1.8.26Affected

References

ExploitDB-51136exploit
Official myBB Software Version Pageproduct
VulnCheck Advisory: myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Managementthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.