CVE-2023-53978

myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements

State: Published
Severity: 5.1 Medium
Published: Dec 22, 2025
Updated: Apr 7, 2026
Reserved: Dec 20, 2025

Description

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject malicious scripts when creating announcements. Attackers can exploit this vulnerability by inserting script payloads in the announcement title field when adding announcements through the 'Forums and Posts' > 'Forum Announcements' interface, causing arbitrary JavaScript to execute when the announcement is displayed on the forum.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
myBB forumsMybb	1.8.26Affected

References

ExploitDB-51136exploit
Official myBB Software Version Pageproduct
VulnCheck Advisory: myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcementsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.