MyBB Like Plugin 3.0.0 contains a flaw that allows attackers to embed malicious script tags in post subjects. When other members look at the attacker’s profile, the plugin displays liked posts without sanitizing the subject field, so the script executes in their browser. This type of client‑side cross‑site scripting can be used to steal cookies, deface pages, or redirect.

The vulnerability is limited to the MyBB Like Plugin version 3.0.0 installed on MyBB forum software. No other releases or plugins are listed as affected in the available CNA data.

The CVSS base score of 5.1 indicates moderate severity for a client‑side flaw. No EPSS information is supplied and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to create or modify a post with a crafted subject—usually a registered user with posting rights. Once a forum member views the affected profile, the injected script runs automatically, compromising confidentiality and potentially enabling session hijacking, but it does not require remote code execution on the server or network‑level access.