MyBB forum software allows the Buddy/Ignore component to render usernames without proper escaping, enabling attackers to inject JavaScript code into the page. The injection can be triggered when a victim confirms removal of a nickname in usercp.php or selects a nickname via the onclick handler in the Select Buddies popup. Successful exploitation results in client‑side code execution in the victim’s browser, which can lead to theft of session cookies, access token hijacking, or defacement of the site. The weakness is a Cross‑Site Scripting flaw (CWE‑79).

MyBB Forum software, versions prior to 1.8.40. The vulnerability exists in the Buddy/Ignore module and the Private Messages Select Buddies list where usernames are displayed. Upgrading to version 1.8.40 or later resolves the issue.

The CVSS score of 8.7 classifies the flaw as high severity, and the EPSS score is not available, indicating no current quantitative analysis of exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to create or own a username containing malicious code and for a victim to view that username in a context that triggers the unsanitized output. Once a victim’s browser processes the injected script, the attacker can hijack the user session or execute arbitrary client‑side actions. The attack vector is a web application attack via the user interface. The need for a vulnerable username means social engineering or targeted phishing may be necessary to attract victims to the affected page.