CVE-2026-45116
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
MyBB before version 1.8.40 has a stored JavaScript code injection vulnerability in checkbox and multiselect profile field types. Profile field validation does not properly handle non-array values, allowing malicious code to be stored and rendered without processing by the MyCode parser.
Risk Assessment
An attacker can inject persistent JavaScript that executes in other users' browsers, potentially leading to session theft, account takeover, or other attacks.
Recommendation
Upgrade MyBB to version 1.8.40 or later, which includes the fix.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.