https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2018-25250.htmlhttps://patchthecve.com/cve/CVE-2018-25250.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.2: MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by crafting thread subjects with script tags. Attackers can create threads with script payloads in the subject field that execute when users visithttps://patchthecve.com/cve/CVE-2018-25249.htmlhttps://patchthecve.com/cve/CVE-2018-25249.htmlTue, 21 Jul 2026 07:10:00 +0000MEDIUM 6.4: MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit thhttps://patchthecve.com/cve/CVE-2018-25248.htmlhttps://patchthecve.com/cve/CVE-2018-25248.htmlMon, 20 Jul 2026 20:10:00 +0000HIGH 7.2: MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators valihttps://patchthecve.com/cve/CVE-2018-25247.htmlhttps://patchthecve.com/cve/CVE-2018-25247.htmlTue, 21 Jul 2026 07:10:00 +0000MEDIUM 6.1: MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the vie