MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field. Attackers can inject malicious scripts that will execute in the admin interface when viewing delete account reasons.
deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.