CVE-2018-25249

MEDIUM 6.4

MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

CWE	CWE-79
Vendor	mybb
Product	mybb my arcade plugin
Published	Apr 4, 2026
Last Updated	May 24, 2026

Stay Ahead of the Next One

Get instant alerts for mybb mybb my arcade plugin

Be the first to know when new medium vulnerabilities affecting mybb mybb my arcade plugin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

MyBB / MyBB My Arcade Plugin

1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/44186 community.mybb.com: https://community.mybb.com/mods.php?action=view&pid=411 vulncheck.com: https://www.vulncheck.com/advisories/mybb-my-arcade-plugin-persistent-xss-via-comment

Credits

0xB9