CVE-2018-25248 MyBB CVE debrief

Who should care

Administrators and users of MyBB with the Downloads Plugin 2.0.3 installed should be aware of this vulnerability. This vulnerability could potentially allow attackers to inject malicious scripts, leading to security risks. Users with permission to submit downloads should be cautious, and administrators should prioritize updating the plugin.

Technical summary

The MyBB Downloads Plugin 2.0.3 is vulnerable to persistent cross-site scripting (XSS). An attacker can exploit this by submitting a new download with malicious HTML/JavaScript code in the title parameter. When an administrator validates the download in downloads.php, the code executes. This vulnerability requires the attacker to have permissions to submit downloads. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Medium priority should be given to updating the MyBB Downloads Plugin to a version that fixes this vulnerability.

Recommended defensive actions

• Update the MyBB Downloads Plugin to a version that fixes this vulnerability.
• Restrict permissions for submitting downloads to trusted users.
• Monitor downloads.php for suspicious activity.
• Implement additional security measures to detect and prevent XSS attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-04T14:16:20.683Z and was last modified on 2026-07-20T20:10:00.110Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects MyBB with the Downloads Plugin 2.0.3 installed. Evidence of exploitation is not provided, and defenders should verify the vulnerability's existence and potential impact on their systems.

Official resources