CVE-2021-41866: Mybb

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.

Affected products

• Mybb Mybb: before 1.8.28 (fixed in 1.8.28)

Published 2021-10-26. Last modified 2026-06-17.