ZeroDay Findings
Sign inSign up

Findings

CVE-2018-25247

MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability.

Published Apr 4, 2026 · updated Jul 21, 2026 · mybb thankyou/like system

MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 4, 2026 · NIST NVD

    Detected

    MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.

  2. Jul 21, 2026 · NIST NVD

    Updated

    MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.

Affected

  • cpe mybb/thankyou/like systemversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2018-25247

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2018-25247

    MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing t

    nvd.nist.gov

References