CVE-2018-25132

MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting

MEDIUM 5.1EPSS 0.2%

MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attackers can modify thread titles with script payloads that will execute when other users view the trending widget.

Affected: zainali99 · MyBB Trending Widget Plugin
CVSS v4.0 VULNCHECK: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.25% chance of exploitation in the next 30 days, 15th percentile
Published: 2026-01-23

Proof-of-concept exploits (1)

https://www.exploit-db.com/exploits/49504

Security advisories

https://www.vulncheck.com/advisories/mybb-trending-widget-plugin-cross-site-scripting
zainali99/trends-widget

References

CVE Record
NVD entry