The OUGC Awards plugin prior to 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.
ougc awards project ougc awards