A persistent cross-site scripting vulnerability in the MyBB Recent Threads plugin allows attackers to execute arbitrary JavaScript in the browsers of users, posing a significant risk to session security.

This vulnerability is a persistent cross-site scripting (XSS) flaw occurring due to improper neutralization of input within the thread subject parameter. By crafting a thread title containing malicious script tags, an attacker can ensure that arbitrary JavaScript executes whenever a user visits the index page of the forum.

Successful exploitation allows an attacker to execute malicious scripts within the context of a victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive session tokens. Given the CVSS score of 7.2, this vulnerability represents a high risk to the integrity and confidentiality of user accounts and forum operations.

Immediate Action: Administrators should immediately disable or uninstall the MyBB Recent Threads plugin until a patched version is provided by the vendor, as no official fix is currently confirmed.

Proactive Monitoring: Review web server logs for suspicious activity involving the creation of threads with unusual subject lines containing script tags or HTML entities.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize input for JavaScript injection patterns, specifically targeting the forum thread creation endpoints.

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 44420.

Due to the persistent nature of this vulnerability and the availability of a public proof-of-concept, the risk of exploitation is elevated. Administrators should prioritize the removal or mitigation of this plugin immediately to prevent potential account compromise and unauthorized script execution across their user base.