PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25248 MyBB CVE debrief

The MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability. This vulnerability allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. Administrators and users of MyBB with the Downloads Plugin 2.0.3 installed should be aware of this vulnerability.

Vendor
MyBB
Product
MyBB Downloads Plugin
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-04
Original CVE updated
2026-07-20
Advisory published
2026-04-04
Advisory updated
2026-07-20

Who should care

Administrators and users of MyBB with the Downloads Plugin 2.0.3 installed should be aware of this vulnerability. This vulnerability could potentially allow attackers to inject malicious scripts, leading to security risks. Users with permission to submit downloads should be cautious, and administrators should prioritize updating the plugin.

Technical summary

The MyBB Downloads Plugin 2.0.3 is vulnerable to persistent cross-site scripting (XSS). An attacker can exploit this by submitting a new download with malicious HTML/JavaScript code in the title parameter. When an administrator validates the download in downloads.php, the code executes. This vulnerability requires the attacker to have permissions to submit downloads. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Medium priority should be given to updating the MyBB Downloads Plugin to a version that fixes this vulnerability.

Recommended defensive actions

  • Update the MyBB Downloads Plugin to a version that fixes this vulnerability.
  • Restrict permissions for submitting downloads to trusted users.
  • Monitor downloads.php for suspicious activity.
  • Implement additional security measures to detect and prevent XSS attacks.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-04T14:16:20.683Z and was last modified on 2026-07-20T20:10:00.110Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects MyBB with the Downloads Plugin 2.0.3 installed. Evidence of exploitation is not provided, and defenders should verify the vulnerability's existence and potential impact on their systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-25248 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-25248

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-25248 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-25248

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.