CVE-2018-25249: MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

Published Apr 4, 2026

Updated

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

Affected Software

1 affected component

MyBB My Arcade Mybb=1.3

Event History

Apr 4, 2026

CVE Published

via MITRE·01:51 PM

Data Sourced

via MITRE·01:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2018-25249?

CVE-2018-25249 is classified as a medium severity vulnerability due to its potential for persistent cross-site scripting attacks.

How do I fix CVE-2018-25249?

To fix CVE-2018-25249, you should upgrade MyBB My Arcade Plugin to the latest version that addresses this vulnerability.

Who is affected by CVE-2018-25249?

Authenticated users of MyBB My Arcade Plugin version 1.3 are affected by CVE-2018-25249.

What type of vulnerability is CVE-2018-25249?

CVE-2018-25249 is a persistent cross-site scripting (XSS) vulnerability.

Can attackers exploit CVE-2018-25249 even with user authentication?

Yes, attackers can exploit CVE-2018-25249 to inject malicious scripts even if the user is authenticated.