MyBB version 1.6.x with ChangUonDyU Chatbox plugin version 3.6.0 suffers from a cross site scripting vulnerability.