MyBB Recent threads 17.0 contains a persistent cross‑site scripting vulnerability that allows malicious scripts to be injected via the thread subject field. Attackers create threads containing script tags, which are stored in the database and rendered unfiltered on the index page, enabling arbitrary JavaScript execution in the browsers of all users who view the index. The vulnerability is a stored XSS flaw (CWE‑79) that can lead to session hijacking, defacement, or data theft in the victim’s browser.

The issue afflicts MyBB Recent threads, version 17.0. Users running this exact version are susceptible.

The CVSS score of 5.1 classifies it as medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only the ability to create new threads, which most forum users possess, making exploitation straightforward. The vulnerability is saved on the server and then displayed to all visitors of the index page, providing a broad attack surface.