The MyBB Last User's Threads in Profile Plugin 1.2 is vulnerable to persistent cross-site scripting, which could allow an attacker to execute malicious scripts in the context of a victim's session.

This is a persistent cross-site scripting (CWE-79) vulnerability occurring in the plugin's handling of thread subject fields. An authenticated user can inject malicious scripts into the subject field, which then execute when a victim views the attacker's profile page.

A successful exploit allows an attacker to execute arbitrary JavaScript in the browser of any user who visits the compromised profile. This could lead to session hijacking, unauthorized actions performed on behalf of the victim, or the redirection of users to malicious external sites. With a CVSS score of 7.2, this vulnerability represents a high risk to the integrity and security of the forum environment.

Immediate Action: Update the MyBB Last User's Threads in Profile Plugin to the patched version, or apply the fix provided in the vendor repository commit (5e3b81450d0bf7935885db2622f1a42e5961258d).

Proactive Monitoring: Review forum activity logs for anomalous thread subject entries containing script tags or suspicious encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect input fields for common XSS patterns, specifically looking for script tags and event handlers in user-submitted content.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 44339.

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this persistent XSS vulnerability. Administrators must prioritize the application of the available patch to prevent potential account takeovers and the compromise of user sessions. If patching is not immediately feasible, consider disabling the plugin until a secure version can be implemented.