CVE-2026-45115
Received Received - Intake

Stored XSS in MyBB Forum Software via Username Injection

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-07
NVD
CVE-2026-45115
EUVD
EUVD-2026-61005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb to 1.8.40 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a JavaScript code injection flaw in MyBB forum software versions before 1.8.40. Attackers can exploit it by creating a specially crafted username containing malicious JavaScript code. The issue occurs because usernames are not properly sanitized, allowing single quotes to remain unescaped when passed through htmlspecialchars_uni().

Detection Guidance

Check MyBB version for 1.8.40 or higher. Inspect usernames in Buddy/Ignore lists and Private Messages for JavaScript code injection attempts. Look for single quotes in usernames that may trigger onclick events.

Impact Analysis

If you are a MyBB user, an attacker could trick you into executing malicious JavaScript when you interact with certain features like the Buddy/Ignore list or Private Messages Select Buddies popup. This could lead to session hijacking, data theft, or account takeover.

Compliance Impact

This vulnerability could lead to unauthorized script execution in user browsers, potentially enabling attackers to steal session cookies, sensitive data, or perform actions on behalf of users. This may violate GDPR's data protection requirements for confidentiality and integrity, and HIPAA's safeguards for protected health information if exploited in healthcare forums.

Mitigation Strategies

Upgrade MyBB to version 1.8.40 or later immediately. Review and sanitize existing usernames to remove any malicious payloads. Monitor for suspicious activity in Buddy/Ignore and Private Message systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart