The MyBB Timeline Plugin version 1.0 contains cross‑site scripting flaws that let attackers inject malicious scripts into thread titles, post content, and profile fields such as Location and Bio. In addition, the timeline.php profile action is vulnerable to cross‑site request forgery, enabling an attacker to craft a form that changes a user’s cover picture when the victim visits the affected profile. These weaknesses allow the execution of arbitrary client‑side code in any browser that renders the content. The potential consequences, such as session hijacking, credential theft, or page defacement, are inferred from the nature of XSS and are not explicitly stated in the advisory.

The affected product is the MyBB Timeline Plugin, version 1.0, distributed by MyBB. No other product variants or versions are listed.

The CVSS base score of 6.9 indicates moderate impact. The vulnerability is exploitable over the network via the web interface and requires a victim to view the compromised content. Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation is uncertain and depends largely on attacker activity in online forums. The CSRF vector expands the threat because any authenticated user could become a victim if they visit a malicious link or form, though the flaw does not provide direct remote code execution on the server.