CVE-2021-47934 | THREATINT

Description

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php profile action to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles.

PUBLISHED Reserved 2026-02-01 | Published 2026-05-16 | Updated 2026-05-18 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

1.0

affected

Credits

0xB9 finder

References

www.exploit-db.com/exploits/49467 (ExploitDB-49467) exploit

community.mybb.com/mods.php?action=view&pid=1428 (Product Reference) product

www.vulncheck.com/...ne-plugin-cross-site-scripting-and-csrf (VulnCheck Advisory: MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF) third-party-advisory

cve.org (CVE-2021-47934)

nvd.nist.gov (CVE-2021-47934)

Download JSON