Medium severity5.3NVD Advisory· Published May 16, 2026· Updated May 18, 2026

CVE-2021-47934

Description

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php profile action to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

MyBB/Mybbllm-fuzzy
Range: = 1.0

Patches

Vulnerability mechanics

References

community.mybb.com/mods.phpnvd
www.exploit-db.com/exploits/49467nvd
www.vulncheck.com/advisories/mybb-timeline-plugin-cross-site-scripting-and-csrfnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000