Mang Board CVE-2026-104761

Requires an authenticated WordPress account with 'custom-level' access or above on a site running the Mang Board plugin (versions <= 2.4.3); the attacker must be able to submit data through the 'content' parameter handled by the plugin's mb-template.php/func.api.php code paths. The payload is stored and fires without further attacker action, but execution depends on another user or administrator subsequently viewing the injected page. Primary limiting factors: the PR:L authentication requirement (not exploitable by fully unauthenticated attackers) and the need for the site to grant custom-level accounts; impact is confined to the browser/session of page viewers rather than the server itself.

This is a moderate-severity, authenticated stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that should be treated as a routine patch-management item rather than an emergency. The network vector and low attack complexity favor exploitation, but PR:L is the key limiting signal: an attacker must already hold a 'custom-level' (or higher) authenticated account on the target WordPress site, which substantially narrows the viable attacker population. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis - all three exploitation-maturity signals are either absent or negative, which is consistent with a low real-world urgency. The S:C (scope change) and C:L/I:L impacts correctly reflect that injected script executes in the browser context of other users/administrators who view the page, enabling session or UI compromise rather than direct server takeover. Net: a legitimate issue to patch, but not a high-priority, mass-exploitation threat; the main residual risk is a multi-user or membership site where lower-privileged 'custom' accounts can be obtained and used to attack admins.

An attacker who holds or registers a custom-level account on a WordPress site running Mang Board submits a crafted payload in the 'content' parameter, which is stored without sufficient sanitization. When an administrator or other visitor later opens the affected page, the script runs in their browser - potentially stealing session cookies or performing actions as that user. No public exploit code was referenced, and the low attack complexity (AC:L) means no special timing or conditions are needed beyond having the required account.