CVE-2018-19201

A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the ‘username’ parameter.

Date published : 2019-03-29

MyBB 1.8.20 Released — Security & Maintenance Release

https://github.com/mybb/mybb/blob/feature/SECURITY.md#technical-details-of-known-issues