Vulnerability record · CVE-2018-17128 · published 17 September 2018
CVE-2018-17128: MyBB Visual Editor persistent XSS via Video MyCode
Mybb · Mybb
MyBB before 1.8.19 contains a persistent cross-site scripting flaw in the Visual Editor, reachable through a Video MyCode. Because the injected script is stored and later rendered to other users, it can execute in their browsers under the forum's origin. The record does not specify the exact parameter or encoding failure.
Description
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Automated analysis
high priorityPublic exploit code exists and EPSS is very high, but exploitation requires an authenticated low-privilege poster plus victim interaction, keeping it below critical.
What it is
MyBB before 1.8.19 contains a persistent cross-site scripting flaw in the Visual Editor, reachable through a Video MyCode. Because the injected script is stored and later rendered to other users, it can execute in their browsers under the forum's origin. The record does not specify the exact parameter or encoding failure.
Impact
An attacker can run arbitrary script in the session of any user who views the affected post, enabling cookie or token theft, session hijacking, or actions performed as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.
Attack surface
Reached over the network through the Visual Editor when posting content containing a crafted Video MyCode. The vector requires low privileges (PR:L) and user interaction (UI:R), so an authenticated low-privilege user must post the payload and a victim must view the resulting content.
Exploitation
No CISA KEV listing. EPSS is high (0.74752, 99.477th percentile), and a public Exploit-DB entry (45449) exists, indicating exploit code is publicly available.
What to do
- Upgrade MyBB to 1.8.19 or later, which the vendor release notes identify as the fix.
- If immediate upgrade is not possible, restrict or disable the Video MyCode and review Visual Editor input handling.
- Sanitize and encode stored post content on output, and apply a Content Security Policy to limit script execution.
- Limit posting privileges for untrusted users until patched.
Detection
- Search forum posts and database content for Video MyCode tags containing script elements or event handlers.
- Monitor web logs and application logs for requests submitting Video MyCode payloads with script-like content.
- Review browser-side alerts or reports of unexpected script execution on forum pages rendering Video MyCode content.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/ | Release NotesVendor Advisory |
| https://www.exploit-db.com/exploits/45449/ | ExploitThird Party AdvisoryVDB Entry |
| https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/ | Release NotesVendor Advisory |
| https://www.exploit-db.com/exploits/45449/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2018-17128 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-17128), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
