The MyBB Downloads Plugin 2.0.3 contains a persistent cross‑site scripting flaw that lets any regular member inject JavaScript or HTML into the title field when creating a new download. When an administrator later approves the download through downloads.php, the injected code executes in the administrator’s browser. This can lead to session hijacking, credential theft, or defacement within the site’s administrative interface.

All sites running MyBB Downloads Plugin version 2.0.3 are vulnerable. The flaw targets the title field of the downloads.php interface and does not require elevated privileges to exploit, as any regular member can submit a malicious title.

The CVSS score of 5.1 indicates a medium severity attack, and the EPSS score of less than 1% signals a low probability of automated exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the attack vector is web‑based input validation, an attacker only requires web access and a valid user account to create the malicious download, making it relatively easy to execute. The impact is limited to administrative sessions but can be leveraged to compromise site control if the admin’s session is hijacked.