MyBB forum software versions prior to 1.8.40 do not validate checkbox and multiselect profile field data correctly. During profile updates, the UserDataHandler::verify_profile_fields() routine only performs specialized validation when the field value is an array; when the value is a single string it passes through generic text handling and is stored without verification. The stored string is later rendered directly by member.php and inc/functions_post.php without passing through the MyCode parser. As a result, if a malicious user stores JavaScript code in a checkbox or multiselect profile field, that code will be executed in the browser of any user who views the affected profile or post, constituting a stored cross‑site scripting flaw.

The issue affects MyBB installations running any version earlier than 1.8.40. It targets users who have checkbox or multiselect profile fields configured and use the standard UserDataHandler::verify_profile_fields() routine to process those fields. Every user of an affected MyBB instance is at risk, regardless of the specific profile fields or site configuration.

The CVSS score of 8.7 indicates a high‑severity vulnerability. EPSS data is unavailable and the flaw is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale exploitation yet. Attackers can exploit the flaw by creating or editing a checkbox or multiselect profile field with a malicious JavaScript payload; the payload is stored without sanitation and executed when the stored content is rendered. The attack is enabled for anyone who can modify the profile fields and for any visitor who views the rendered data.