CVE-2018-14392: MyBB New Threads plugin stored XSS before 1.2

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 6.1 medium with a public exploit and very high EPSS, but exploitation requires user interaction and the affected component is a third-party plugin rather than MyBB core.

What it is

The New Threads plugin for MyBB before version 1.2 is vulnerable to cross-site scripting (CWE-79). An attacker can inject script that executes in the browser of a victim viewing affected plugin output, which matters because MyBB forums are multi-user and session theft or forum defacement can follow.

Impact

An attacker can run arbitrary script in a victim's browser in the context of the forum, potentially stealing session cookies or performing actions as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network with no privileges required, but exploitation requires user interaction (UI:R) because the victim must view the crafted content. The record does not specify the exact injection point or whether authentication is needed to post the payload.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (45057) exists and EPSS is 0.48557 (98.8th percentile), indicating meaningful likelihood of exploitation. No ransomware association is documented.

What to do

• Upgrade the New Threads plugin to version 1.2 or later.
• If upgrade is not possible, disable or remove the plugin until it can be patched.
• Apply output encoding and input sanitization to plugin-generated content.
• Deploy a web application firewall or content security policy to reduce script injection impact.
• Review forum accounts and sessions for signs of compromise after exposure.

Detection

• Search web and proxy logs for script tags or encoded script payloads in requests to New Threads plugin endpoints.
• Monitor for anomalous session activity or account changes following plugin page views.
• Use file integrity monitoring on the plugin directory to detect unauthorized modification.
• Alert on outbound requests from forum pages to unexpected external domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.