Security readout for executives and security teams
Plain-English summary
CVE-2021-47934 affects MyBB Timeline Plugin 1.0. It can let unauthenticated attackers place script content in forum or profile data and abuse a profile action to change a user's cover picture through CSRF. Business impact is mainly account trust, user safety, and forum integrity rather than server takeover.
Executive priority
Treat as a moderate priority for any public MyBB forum using this plugin. Prioritize validation because user-facing script injection can damage trust and expose users to account or session abuse. If the plugin is present, remove or disable it unless vendor guidance confirms a safe version.
Technical view
The issue combines stored cross-site scripting in thread titles, post content, Location, and Bio fields with CSRF in the timeline.php profile action. The CVE lists CVSS 4.0 score 6.9. The affected product named in sources is MyBB Timeline Plugin version 1.0. CWE-79 is assigned.
Likely exposure
Exposure is limited to sites running MyBB with the Timeline Plugin 1.0 installed and enabled. Public-facing forums with user-generated content or profile pages are the primary concern. The provided sources do not identify other affected versions or core MyBB as affected.
Exploitation context
Exploit-DB is cited, so public exploit information exists. The source bundle does not show CISA KEV listing or evidence of active exploitation. Abuse would likely target forum visitors or logged-in users through malicious forum or profile content and cross-site requests.
Researcher notes
The advisory scope is narrow: MyBB Timeline Plugin 1.0. Sources describe XSS vectors and CSRF in timeline.php profile action, but no patch details are included in the bundle. Avoid broad assumptions about MyBB core or other plugin versions. Public exploit reference exists, but active exploitation is not established.
Mitigation direction
- Identify whether MyBB Timeline Plugin 1.0 is installed and enabled.
- Check the MyBB plugin page and advisory sources for vendor guidance or fixed releases.
- Disable or remove the Timeline Plugin if it is not business-critical.
- Restrict untrusted profile and forum content until remediation is confirmed.
- Review and clean suspicious script-like content in affected fields.
Validation and detection
- Inventory MyBB sites and installed plugin versions.
- Confirm whether Timeline Plugin version 1.0 is present.
- Review thread titles, posts, Location, and Bio fields for unexpected scripts.
- Check profile cover picture changes for unusual or user-disputed activity.
- Monitor vendor and advisory pages for updated remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47934 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49467CVE reference, VulnCheck · exploit
- Product ReferenceCVE reference, VulnCheck · product
- VulnCheck Advisory: MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRFCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.