MyBB Like Plugin 3.0.0 has a stored cross‑site scripting flaw that allows an authenticated user to insert script payloads into post or thread subjects. When other forum members view the attacker’s profile, the plugin renders the un‑sanitized subject, which causes the script to execute in the viewer’s browser. This client‑side exploitation can be used to steal session cookies, deface pages, or redirect traffic.

The vulnerability is limited to the MyBB Like Plugin version 3.0.0 installed on MyBB forum software. No other releases or plugins are listed as affected in the available CNA data.

The CVSS base score of 5.1 indicates moderate severity for a client‑side flaw. The EPSS score of < 1% indicates low but non‑zero chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to create or modify a post or thread with a crafted subject—usually an authenticated user with posting rights. Once a forum member views the affected profile, the injected script runs automatically, compromising confidentiality and potentially enabling session hijacking, but it does not require remote code execution on the server or network‑level access.