MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP → Configuration → Settings → Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP → Your Profile → Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP → Configuration → Settings_): - _Clickable Smilies and BB Code → [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP → Your Profile → Edit Options_) _Show the MyCode formatting options on the posting pages_.

• https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276
• https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8
• https://mybb.com/versions/1.8.37/
• https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276
• https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8
• https://mybb.com/versions/1.8.37/

• Mybb » Mybb » Version: 1.0
  cpe:2.3:a:mybb:mybb:1.0
• Mybb » Mybb » Version: 1.0.2
  cpe:2.3:a:mybb:mybb:1.0.2
• Mybb » Mybb » Version: 1.00
  cpe:2.3:a:mybb:mybb:1.00
• Mybb » Mybb » Version: 1.01
  cpe:2.3:a:mybb:mybb:1.01
• Mybb » Mybb » Version: 1.02
  cpe:2.3:a:mybb:mybb:1.02
• Mybb » Mybb » Version: 1.03
  cpe:2.3:a:mybb:mybb:1.03
• Mybb » Mybb » Version: 1.04
  cpe:2.3:a:mybb:mybb:1.04
• Mybb » Mybb » Version: 1.1.0
  cpe:2.3:a:mybb:mybb:1.1.0
• Mybb » Mybb » Version: 1.1.1
  cpe:2.3:a:mybb:mybb:1.1.1
• Mybb » Mybb » Version: 1.1.2
  cpe:2.3:a:mybb:mybb:1.1.2
• Mybb » Mybb » Version: 1.1.3
  cpe:2.3:a:mybb:mybb:1.1.3
• Mybb » Mybb » Version: 1.1.4
  cpe:2.3:a:mybb:mybb:1.1.4
• Mybb » Mybb » Version: 1.1.5
  cpe:2.3:a:mybb:mybb:1.1.5
• Mybb » Mybb » Version: 1.1.6
  cpe:2.3:a:mybb:mybb:1.1.6
• Mybb » Mybb » Version: 1.1.7
  cpe:2.3:a:mybb:mybb:1.1.7
• Mybb » Mybb » Version: 1.1.8
  cpe:2.3:a:mybb:mybb:1.1.8
• Mybb » Mybb » Version: 1.2
  cpe:2.3:a:mybb:mybb:1.2
• Mybb » Mybb » Version: 1.2.0
  cpe:2.3:a:mybb:mybb:1.2.0
• Mybb » Mybb » Version: 1.2.1
  cpe:2.3:a:mybb:mybb:1.2.1
• Mybb » Mybb » Version: 1.2.10
  cpe:2.3:a:mybb:mybb:1.2.10
• Mybb » Mybb » Version: 1.2.11
  cpe:2.3:a:mybb:mybb:1.2.11
• Mybb » Mybb » Version: 1.2.12
  cpe:2.3:a:mybb:mybb:1.2.12
• Mybb » Mybb » Version: 1.2.13
  cpe:2.3:a:mybb:mybb:1.2.13
• Mybb » Mybb » Version: 1.2.14
  cpe:2.3:a:mybb:mybb:1.2.14
• Mybb » Mybb » Version: 1.2.2
  cpe:2.3:a:mybb:mybb:1.2.2
• Mybb » Mybb » Version: 1.2.3
  cpe:2.3:a:mybb:mybb:1.2.3
• Mybb » Mybb » Version: 1.2.4
  cpe:2.3:a:mybb:mybb:1.2.4
• Mybb » Mybb » Version: 1.2.5
  cpe:2.3:a:mybb:mybb:1.2.5
• Mybb » Mybb » Version: 1.2.6
  cpe:2.3:a:mybb:mybb:1.2.6
• Mybb » Mybb » Version: 1.2.7
  cpe:2.3:a:mybb:mybb:1.2.7
• Mybb » Mybb » Version: 1.2.8
  cpe:2.3:a:mybb:mybb:1.2.8
• Mybb » Mybb » Version: 1.2.9
  cpe:2.3:a:mybb:mybb:1.2.9
• Mybb » Mybb » Version: 1.3
  cpe:2.3:a:mybb:mybb:1.3
• Mybb » Mybb » Version: 1.4.0
  cpe:2.3:a:mybb:mybb:1.4.0
• Mybb » Mybb » Version: 1.4.1
  cpe:2.3:a:mybb:mybb:1.4.1
• Mybb » Mybb » Version: 1.4.10
  cpe:2.3:a:mybb:mybb:1.4.10
• Mybb » Mybb » Version: 1.4.11
  cpe:2.3:a:mybb:mybb:1.4.11
• Mybb » Mybb » Version: 1.4.12
  cpe:2.3:a:mybb:mybb:1.4.12
• Mybb » Mybb » Version: 1.4.13
  cpe:2.3:a:mybb:mybb:1.4.13
• Mybb » Mybb » Version: 1.4.14
  cpe:2.3:a:mybb:mybb:1.4.14
• Mybb » Mybb » Version: 1.4.15
  cpe:2.3:a:mybb:mybb:1.4.15
• Mybb » Mybb » Version: 1.4.16
  cpe:2.3:a:mybb:mybb:1.4.16
• Mybb » Mybb » Version: 1.4.2
  cpe:2.3:a:mybb:mybb:1.4.2
• Mybb » Mybb » Version: 1.4.3
  cpe:2.3:a:mybb:mybb:1.4.3
• Mybb » Mybb » Version: 1.4.4
  cpe:2.3:a:mybb:mybb:1.4.4
• Mybb » Mybb » Version: 1.4.5
  cpe:2.3:a:mybb:mybb:1.4.5
• Mybb » Mybb » Version: 1.4.6
  cpe:2.3:a:mybb:mybb:1.4.6
• Mybb » Mybb » Version: 1.4.7
  cpe:2.3:a:mybb:mybb:1.4.7
• Mybb » Mybb » Version: 1.4.8
  cpe:2.3:a:mybb:mybb:1.4.8
• Mybb » Mybb » Version: 1.4.9
  cpe:2.3:a:mybb:mybb:1.4.9
• Mybb » Mybb » Version: 1.5.1
  cpe:2.3:a:mybb:mybb:1.5.1
• Mybb » Mybb » Version: 1.5.2
  cpe:2.3:a:mybb:mybb:1.5.2
• Mybb » Mybb » Version: 1.6.0
  cpe:2.3:a:mybb:mybb:1.6.0
• Mybb » Mybb » Version: 1.6.1
  cpe:2.3:a:mybb:mybb:1.6.1
• Mybb » Mybb » Version: 1.6.10
  cpe:2.3:a:mybb:mybb:1.6.10
• Mybb » Mybb » Version: 1.6.11
  cpe:2.3:a:mybb:mybb:1.6.11
• Mybb » Mybb » Version: 1.6.12
  cpe:2.3:a:mybb:mybb:1.6.12
• Mybb » Mybb » Version: 1.6.13
  cpe:2.3:a:mybb:mybb:1.6.13
• Mybb » Mybb » Version: 1.6.14
  cpe:2.3:a:mybb:mybb:1.6.14
• Mybb » Mybb » Version: 1.6.15
  cpe:2.3:a:mybb:mybb:1.6.15
• Mybb » Mybb » Version: 1.6.16
  cpe:2.3:a:mybb:mybb:1.6.16
• Mybb » Mybb » Version: 1.6.17
  cpe:2.3:a:mybb:mybb:1.6.17
• Mybb » Mybb » Version: 1.6.18
  cpe:2.3:a:mybb:mybb:1.6.18
• Mybb » Mybb » Version: 1.6.2
  cpe:2.3:a:mybb:mybb:1.6.2
• Mybb » Mybb » Version: 1.6.3
  cpe:2.3:a:mybb:mybb:1.6.3
• Mybb » Mybb » Version: 1.6.4
  cpe:2.3:a:mybb:mybb:1.6.4
• Mybb » Mybb » Version: 1.6.5
  cpe:2.3:a:mybb:mybb:1.6.5
• Mybb » Mybb » Version: 1.6.6
  cpe:2.3:a:mybb:mybb:1.6.6
• Mybb » Mybb » Version: 1.6.7
  cpe:2.3:a:mybb:mybb:1.6.7
• Mybb » Mybb » Version: 1.6.8
  cpe:2.3:a:mybb:mybb:1.6.8
• Mybb » Mybb » Version: 1.6.9
  cpe:2.3:a:mybb:mybb:1.6.9
• Mybb » Mybb » Version: 1.8.0
  cpe:2.3:a:mybb:mybb:1.8.0
• Mybb » Mybb » Version: 1.8.1
  cpe:2.3:a:mybb:mybb:1.8.1
• Mybb » Mybb » Version: 1.8.10
  cpe:2.3:a:mybb:mybb:1.8.10
• Mybb » Mybb » Version: 1.8.11
  cpe:2.3:a:mybb:mybb:1.8.11
• Mybb » Mybb » Version: 1.8.12
  cpe:2.3:a:mybb:mybb:1.8.12
• Mybb » Mybb » Version: 1.8.13
  cpe:2.3:a:mybb:mybb:1.8.13
• Mybb » Mybb » Version: 1.8.14
  cpe:2.3:a:mybb:mybb:1.8.14
• Mybb » Mybb » Version: 1.8.15
  cpe:2.3:a:mybb:mybb:1.8.15
• Mybb » Mybb » Version: 1.8.16
  cpe:2.3:a:mybb:mybb:1.8.16
• Mybb » Mybb » Version: 1.8.17
  cpe:2.3:a:mybb:mybb:1.8.17
• Mybb » Mybb » Version: 1.8.18
  cpe:2.3:a:mybb:mybb:1.8.18
• Mybb » Mybb » Version: 1.8.19
  cpe:2.3:a:mybb:mybb:1.8.19
• Mybb » Mybb » Version: 1.8.2
  cpe:2.3:a:mybb:mybb:1.8.2
• Mybb » Mybb » Version: 1.8.20
  cpe:2.3:a:mybb:mybb:1.8.20
• Mybb » Mybb » Version: 1.8.21
  cpe:2.3:a:mybb:mybb:1.8.21
• Mybb » Mybb » Version: 1.8.22
  cpe:2.3:a:mybb:mybb:1.8.22
• Mybb » Mybb » Version: 1.8.23
  cpe:2.3:a:mybb:mybb:1.8.23
• Mybb » Mybb » Version: 1.8.24
  cpe:2.3:a:mybb:mybb:1.8.24
• Mybb » Mybb » Version: 1.8.25
  cpe:2.3:a:mybb:mybb:1.8.25
• Mybb » Mybb » Version: 1.8.26
  cpe:2.3:a:mybb:mybb:1.8.26
• Mybb » Mybb » Version: 1.8.27
  cpe:2.3:a:mybb:mybb:1.8.27
• Mybb » Mybb » Version: 1.8.28
  cpe:2.3:a:mybb:mybb:1.8.28
• Mybb » Mybb » Version: 1.8.29
  cpe:2.3:a:mybb:mybb:1.8.29
• Mybb » Mybb » Version: 1.8.3
  cpe:2.3:a:mybb:mybb:1.8.3
• Mybb » Mybb » Version: 1.8.30
  cpe:2.3:a:mybb:mybb:1.8.30
• Mybb » Mybb » Version: 1.8.31
  cpe:2.3:a:mybb:mybb:1.8.31
• Mybb » Mybb » Version: 1.8.32
  cpe:2.3:a:mybb:mybb:1.8.32
• Mybb » Mybb » Version: 1.8.36
  cpe:2.3:a:mybb:mybb:1.8.36
• Mybb » Mybb » Version: 1.8.4
  cpe:2.3:a:mybb:mybb:1.8.4
• Mybb » Mybb » Version: 1.8.5
  cpe:2.3:a:mybb:mybb:1.8.5
• Mybb » Mybb » Version: 1.8.6
  cpe:2.3:a:mybb:mybb:1.8.6
• Mybb » Mybb » Version: 1.8.7
  cpe:2.3:a:mybb:mybb:1.8.7
• Mybb » Mybb » Version: 1.8.8
  cpe:2.3:a:mybb:mybb:1.8.8
• Mybb » Mybb » Version: 1.8.9
  cpe:2.3:a:mybb:mybb:1.8.9