UBB.threads CVE-2026-54219

Q: What is the CVSS score of CVE-2026-54219?

CVE-2026-54219 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37882 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 CERT-PL

GHSA-mxqw-8v8m-qpmf

XSS Ubb Threads

5.1

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

PR:L for required forum account, UI:R for victim page-load, S:C for stored XSS executing cross-user in browser origin, C:L/I:L for session and content impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 13:31 vuln.today

DescriptionCVE.org

UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser upon viewing.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

AnalysisAI

Stored XSS in UBB.threads 7.7.5 permits low-privileged forum members to permanently inject arbitrary JavaScript into post content and user profile fields, which then executes silently in any visitor's browser upon viewing the affected page. The vulnerability was discovered and disclosed by CERT-PL after unsuccessful vendor contact attempts, leaving remediation status unresolved. No public exploit code has been identified and no active exploitation is confirmed, but the persistent nature of the injection vector makes this a meaningful risk to forum users and administrators alike.

Technical ContextAI

UBB.threads is a PHP-based web forum platform published by UBB Systems (CPE: cpe:2.3:a:ubb_systems:ubb.threads:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant, meaning attacker-supplied payloads are persisted to the database rather than reflected transiently. The root cause is inadequate server-side sanitization of user-controlled input in two distinct surfaces: forum post bodies and user profile fields. When these stored values are later rendered into HTML responses without output encoding, browsers interpret injected script content as executable code within the application's origin, enabling same-origin attacks against any user who views the content.

RemediationAI

No vendor-released patch has been identified at time of analysis, as vendor contact was unsuccessful during CERT-PL's coordinated disclosure process. As an immediate compensating control, deploy a Web Application Firewall with rules targeting common XSS payloads in form submission parameters corresponding to post bodies and profile fields - note this may produce false positives on legitimate HTML markup. Configure a strict Content Security Policy header (e.g., Content-Security-Policy: script-src 'self') to prevent inline script execution, which would neutralize injected payloads even if sanitization fails; this may break any forum features that rely on inline scripts. Restricting new account registration or limiting posting privileges to vetted users reduces the attacker surface at the cost of community accessibility. Monitor https://www.ubbcentral.com/ and https://cert.pl/en/posts/2026/06/CVE-2026-54219 for any future patch releases or vendor response.