CVE-2023-53978: myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements

Published Dec 22, 2025

Updated

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject malicious scripts when creating announcements. Attackers can exploit this vulnerability by inserting script payloads in the announcement title field when adding announcements through the 'Forums and Posts' > 'Forum Announcements' interface, causing arbitrary JavaScript to execute when the announcement is displayed on the forum.

Affected Software

2 affected components

MyBB myBB Forums

MyBB MyBB=1.8.26

Event History

Dec 22, 2025

CVE Published

via MITRE·09:35 PM

Data Sourced

via MITRE·09:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Jul 16, 57959

Event

via MITRE·07:00 PM

Frequently Asked Questions

What is the severity of CVE-2023-53978?

CVE-2023-53978 is classified as a high severity vulnerability due to its potential impact on user security when exploited.

How do I fix CVE-2023-53978?

To fix CVE-2023-53978, ensure you upgrade your myBB Forums to the latest version where this vulnerability is patched.

Who is affected by CVE-2023-53978?

CVE-2023-53978 affects authenticated administrators of myBB Forums 1.8.26 who can create announcements.

What type of vulnerability is CVE-2023-53978?

CVE-2023-53978 is a stored cross-site scripting (XSS) vulnerability.

Can CVE-2023-53978 be exploited remotely?

Yes, CVE-2023-53978 can be exploited remotely by attackers if they have access to the admin interface.