CVE-2018-25248 MEDIUM

CVE-2018-25248: MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php

Vendor Mybb

Product MyBB Downloads Plugin

Weakness CWE-79 · XSS

Published April 4, 2026

Last update May 24, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php.

Key dates

02Disclosure timeline

April 4, 2026 CVE published

May 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-25248 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability CVE-2026-16145 Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter CVE-2026-10734 Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7