What’s added/changed in this version

The vulnerabilities are

High Risk: A SQL injection vulnerability in theme selection - reported by StefanT
Medium Risk: A XSS vulnerability in calender.php - reported by - Acid
Medium Risk: A XSS vulnerability in MyCode editor - reported by My-BB.Ir
Low Risk: A XSS vulnerability related to post icons - reported by Destroy666
Low Risk: unserialize may call PHP magic methods - reported by chtg
Low Risk: PHP setting request_order can break register globals handling - reported by chtg

Additionally we’ve fixed an issue with the video MyCode introduced with MyBB 1.8.2 (#1625) and revised the handling of data fetched from our website as a direct consequence of the compromised GitHub account (#1617). In addition to that, we’ve set the adminsid cookie as httpOnly (#1622). We also plan to add enhanced options to protect the Admin CP like two factor authentication with one of the next maintenance releases.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.