The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3501.json"