CVE-2026-45115

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The Buddy/Ignore component fails to sanitize usernames correctly, enabling JavaScript code injection via a specially crafted username. The issue occurs because the User CP Buddy/Ignore list and the Select Buddies list in Private Messages use the htmlspecialchars uni() function, which may leave single quotes unescaped. The injection is triggered when a user selects Yes during the confirmation process for removing a username in the 'usercp.php' endpoint, or when selecting a username via the onclick handler in the 'xmlhttp.php' Select Buddies popup.

Recommendations Update to version 1.8.40.