CVE-2026-45116

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The user datahandler fails to properly validate checkbox and multiselect profile field types, leading to stored JavaScript code injection. The UserDataHandler::verify profile fields() function only applies specialized validation when is array($profile fields[$field]) is true. If a non-array value is provided for profile fields[fidX] instead of the expected profile fields[fidX][] format, the input bypasses verification and is stored as generic text. This stored value is subsequently rendered directly by member.php and inc/functions post.php without being processed by the MyCode parser.

Recommendations Update to version 1.8.40.