Persistent cross‑site scripting was discovered in the MyBB My Arcade Plugin version 1.3. The flaw allows an authenticated user to insert arbitrary HTML or JavaScript into score comments; when another user views or edits the comment, the malicious code is executed in that user’s browser, potentially stealing session cookies, defacing the site, or redirecting users to malicious sites.

The vulnerability affects installations that run the MyBB My Arcade Plugin 1.3; the plugin’s integration with MyBB 1.3 makes the core forum software indirectly susceptible. Any site that has installed the plugin in its current version without applying a fix is impacted.

The CVSS score of 5.1 places the issue in the medium severity range, and the EPSS score below 1 % indicates a low probability of current exploitation. Because the attack requires authentication, only users with login privileges can inject the payload, yet the resulting XSS can compromise all other forum users that view the vulnerable comment. The vulnerability is not listed in CISA’s KEV catalog, which suggests limited observed exploitation, but the potential for credential theft and defacement warrants moderately high vigilance.