PT-2026-4501 · Mybb · Thread Redirect

Published 2026-01-23 · Updated 2026-01-23 · CVE-2018-25116

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB Thread Redirect plugin version 0.2.1

Description The MyBB Thread Redirect plugin contains a cross-site scripting issue in the custom text input field used for thread redirects. Attackers can inject malicious SVG scripts that execute when other users view the thread, enabling arbitrary script execution.

Recommendations Update to a newer version of the MyBB Thread Redirect plugin that addresses this issue. As a temporary workaround, sanitize all user-provided input for thread redirects.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-25116

Affected Products

Thread Redirect

References · 5

• 🔥 https://exploit-db.com/exploits/49505 · Exploit
• https://osv.dev/vulnerability/CVE-2018-25116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25116 · Security Note
• https://github.com/jamiesage123/Thread-Redirect · Note
• https://vulncheck.com/advisories/mybb-thread-redirect-plugin-cross-site-scripting · Note