Vulnerability · Published Jan 23, 2026 · Assigned by VulnCheck
CVE-2021-47905MyBB Delete Account Plugin 1.4 - Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in MyBB Delete Account Plugin from vintagedaddyo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 83.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field. Attackers can inject malicious scripts that will execute in the admin interface when viewing delete account reasons.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vintagedaddyo | MyBB Delete Account Plugin | 1.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-49500 exploit
- MyBB Delete Account Plugin Repository product
- VulnCheck Advisory: MyBB Delete Account Plugin 1.4 - Cross-Site Scripting third-party-advisory