CVE-2021-27279: Mybb

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).

Affected products

• Mybb Mybb: before 1.8.25 (fixed in 1.8.25)

Published 2021-02-22. Last modified 2026-06-17.