CVE-2018-25248
Received Received - Intake
Persistent XSS in MyBB Downloads Plugin 2.0.3 Allows Script Injection

Publication date: 2026-04-04

Last updated on: 2026-04-10

Assigner: VulnCheck

Description
MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-04
Last Modified
2026-04-10
Generated
2026-06-16
AI Q&A
2026-04-04
EPSS Evaluated
2026-06-15
NVD
CVE-2018-25248
EUVD
EUVD-2018-21748
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb_downloads 2.0.3
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows attackers to inject persistent cross-site scripting (XSS) payloads that execute in the context of an administrator's browser. This can lead to session hijacking or other malicious actions.

Such unauthorized script execution and potential data compromise could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of user data and secure handling of administrative access.

However, the provided information does not explicitly detail the direct effects on compliance with these regulations.

Mitigation Strategies

The immediate mitigation step is to update the MyBB Downloads Plugin to the latest version where this vulnerability has been patched.

Until the update can be applied, restrict regular members from submitting new downloads or disable the downloads submission feature to prevent injection of malicious scripts.

Additionally, administrators should be cautious when validating downloads and consider sanitizing or escaping the download title field manually before approval.

Review and apply the patch available at the GitHub repository: https://github.com/vintagedaddyo/MyBB_Plugin-Downloads/pull/1/commits.

Executive Summary

CVE-2018-25248 is a persistent cross-site scripting (XSS) vulnerability found in MyBB Downloads Plugin version 2.0.3 and earlier. It occurs because the plugin does not properly sanitize user input in the download title field.

Regular members can submit a new download with malicious HTML or JavaScript code embedded in the title. This malicious script then executes when an administrator reviews or validates the download entry via the downloads.php page.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of an administrator's browser when they review submitted downloads.

Potential impacts include session hijacking, unauthorized actions performed with administrator privileges, and other malicious activities that can compromise the security and integrity of the system.

Detection Guidance

This vulnerability can be detected by checking for malicious scripts in the download title field submitted by regular members. Since the issue arises from unsanitized input in the download title, you can look for entries containing suspicious HTML or JavaScript code, such as <BODY ONLOAD=alert('XSS')> or similar payloads.

To detect exploitation attempts, you can search the database or logs for download titles containing HTML or JavaScript tags.

  • Use SQL queries to find suspicious entries in the downloads table, for example: SELECT * FROM downloads WHERE title LIKE '%<script%' OR title LIKE '%<body%';
  • Monitor web server logs for POST requests to the download submission endpoint containing suspicious payloads in the title parameter.
  • Use web application scanners or security tools that detect stored XSS vulnerabilities by submitting test payloads in the download title field and observing if scripts execute during admin validation.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2018-25248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart