Vulnerability · Published Dec 22, 2025 · Assigned by VulnCheck

CVE-2023-53978myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements

Medium 5.4

In plain English

A medium-severity cross-site scripting in myBB forums from Mybb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject malicious scripts when creating announcements. Attackers can exploit this vulnerability by inserting script payloads in the announcement title field when adding announcements through the 'Forums and Posts' > 'Forum Announcements' interface, causing arbitrary JavaScript to execute when the announcement is displayed on the forum.

Affected products (as reported)

Vendor	Product	Versions
Mybb	myBB forums	1.8.26

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

ExploitDB-51136 exploit
Official myBB Software Version Page product
VulnCheck Advisory: myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements third-party-advisory