CVE-2018-25309: medium-severity vulnerability in MyBB Recent threads

MyBB Recent threads 17.0 allows attackers to inject malicious scripts into thread subject lines, which then execute in the browsers of all users viewing the site's index page. This can be used to steal user information or perform unwanted actions on their behalf.

A persistent XSS vulnerability exists in MyBB 17.0's thread subject parameter where insufficient input sanitization allows attackers to inject script tags that execute in the context of other users' browsers. The attack requires the ability to create threads, and payloads persist in the database, affecting all users who view the index page displaying recent threads.