CVE-2018-25247
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The MyBB Like Plugin version 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject malicious scripts into post or thread subjects, which are rendered unsanitized when viewing a profile displaying liked posts.
Risk Assessment
The risk is that an attacker can execute arbitrary scripts in other users' browsers, potentially leading to session theft, account takeover, or sensitive data theft.
Recommendation
Immediately update the Like plugin to the latest patched version or apply a security fix. Additionally, implement input filtering and output encoding for all user-supplied data.
Original NVD description (English source)
MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.