Vulnerability details
CVE-2026-45115
MyBB: Buddy/ignore list username XSS
Official description
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| mybb | mybb | < 1.8.40 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/mybb/mybb/security/advisories/GHSA-p766-qqxv-rfc2 x_refsource_CONFIRM
- https://github.com/mybb/mybb/releases/tag/mybb_1840 x_refsource_MISC
- https://mybb.com/versions/1.8.40 x_refsource_MISC
Details
- Published
- 2026-08-18
- Last updated
- 2026-08-18
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')