MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 4, 2026 · NIST NVD

   Detected

   MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

2. Jul 21, 2026 · NIST NVD

   Updated

   MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

Affected

• cpe mybb/my arcade1.3

Sources

• CVE.orgVulnerability recordCVE-2018-25249

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2018-25249

  MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other u

  nvd.nist.gov

References

• Product · community.mybb.com
• Exploit · exploit-db.com
• Third Party Advisory · vulncheck.com