What is the CVSS score of CVE-2026-107751?

CVE-2026-107751 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-107751?

Within 24 hours, inventory all WordPress installations for the Mang Board plugin and confirm whether any version up to and including 2.4.3 is present; if present, deactivate and remove the plugin or take the affected site offline until mitigations are in place, and deploy WAF virtual patching to block unquoted-attribute XSS payloads in the user_name parameter. Within 7 days, if the plugin cannot be removed, apply output encoding/escaping for user_name values, enforce a strict Content Security Policy, restrict user registration/profile features that accept user_name, scan and clean the database for stored malicious entries, and contact the vendor for a patch timeline; continue monitoring logs for exploitation attempts. Within 30 days, replace Mang Board with a maintained alternative or implement equivalent custom functionality, and when a vendor patch is released, test and apply the exact fixed version to all affected installations; revalidate compensating controls and conduct a follow-up review. No vendor-released patch identified at time of analysis.

Mang Board CVE-2026-107751

EUVD-2026-100907 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-14 Wordfence

GHSA-w243-5v48-g4m5

WordPress XSS Wordpress Plugin Mang Board Kitae Park

7.2

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach board input form over network
Delivery

Submit crafted user_name with unquoted-attribute payload
Exploit

Bypass mbw_htmlspecialchars2 sanitizer, store script
Execution

Victim loads injected page
Impact

Script executes in victim browser session

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No authentication required (CVSS PR:N) and no victim interaction is scored for the injection step: a remote attacker reaches a Mang Board input accepting the 'user_name' parameter and stores a payload built only from spaces, alphanumerics, and =()/. characters, which specifically evades the plugin's mbw_htmlspecialchars2() save-time sanitizer by using unquoted HTML attribute syntax. The vulnerability affects all Mang Board versions up to and including 2.4.3. The practical LIMITING factor is that impact is realized only when a user subsequently loads the page rendering the injected value (stored-XSS trigger is client-side, script-execution scope only - no direct server compromise), and exposure depends on the site actually running the Mang Board plugin with an unpatched version.
Impact	This is a stored XSS flaw (CWE-79) in the Mang Board WordPress plugin, reported by Wordfence. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) indicates network-reachable, low-complexity, unauthenticated injection with a scope change - consistent with stored XSS that executes in the browsers of users (including higher-privileged admins) who later view the injected page. The description adds concrete technical detail explaining why severity is genuine despite the plugin having a save-time sanitizer: mbw_htmlspecialchars2() is bypassed because the payload uses only unquoted HTML-attribute syntax (spaces, alphanumerics, =, parentheses, dots) that the sanitizer does not escape, so the vulnerability is confirmed exploitable rather than theoretical. However, several real-risk signals are MISSING: no EPSS score, no KEV listing, and no public exploit is referenced - so exploitation status is 'no public exploit identified at time of analysis.' There is also no SSVC decision data provided. On balance, this is a credible, vendor-researched (Wordfence) unauthenticated stored XSS, but its real-world priority is tempered by the plugin's apparently limited deployment footprint and the absence of any active-exploitation or exploit-availability evidence. Treat as a patch-soon web-application issue rather than an emergency, pending EPSS/KEV data. Note the C:L/I:L rather than High impact reflects client-side script execution scope rather than full server compromise.
Exploit ScenarioDerived	An unauthenticated attacker submits a crafted 'user_name' value containing an unquoted-HTML-attribute script payload that slips past the plugin's mbw_htmlspecialchars2() sanitizer and is stored by the board. When an administrator or other user later views the page rendering that name, the script executes in their browser session. No public proof-of-concept exploit is referenced in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 14, 2026

Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.

RemediationAI

No vendor-released fixed version number is confirmed in the available data; an upstream fix exists in the plugin trunk as Trac changeset 3738898 touching templates/tpl.button.php (https://plugins.trac.wordpress.org/changeset/3738898/mangboard/trunk/templates/tpl.button.php) - upstream fix available (PR/commit); released patched version not independently confirmed. Track the WordPress.org plugin page and the Wordfence advisory for the tagged release containing this changeset and upgrade to that version as soon as it is published (upgrading beyond 2.4.3 is the goal; do not assume 2.4.3 itself is fixed). Until then, the most effective compensating control is to deactivate the Mang Board plugin if board functionality is not business-critical - this fully removes the attack surface but disables all board features. If the plugin must stay live, reduce exposure by restricting or blocking access to the plugin's API endpoints (notably api/mb-board.php) and any form or parameter accepting 'user_name' at the reverse proxy or WAF, and add a Content-Security-Policy that disallows inline and event-handler script (e.g. script-src without 'unsafe-inline'), which neutralizes unquoted-attribute payload execution but may break legitimate plugin JavaScript and requires testing. Because the root cause is missing output escaping at render time, generic input filtering is unreliable here given the demonstrated sanitizer bypass; any WAF rule should target unquoted-attribute event-handler patterns rather than simple angle-bracket or quote filtering.

Affected VersionsENISA

Mang Board 0 ≤2.4.3

Affected Packages

euvd mang_board no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Mang Board is a WordPress plugin (CPE cpe:2.3:a:kitae-park:mang_board:*:*:*:*:*:*:*:*, vendor Kitae Park) that provides board/skin functionality and exposes data through its own API layer. The flaw is a classic CWE-79 improper neutralization of input during web page generation, here in the stored (persistent) variant. Untrusted input submitted to the 'user_name' field is only passed through the plugin's custom save-time sanitizer mbw_htmlspecialchars2() before being persisted, and later rendered without adequate output escaping in template and skin code paths such as templates/tpl.button.php, includes/skin-filters.php, includes/functions/func.api.php, api/mb-board.php, and includes/mb-actions.php. Because mbw_htmlspecialchars2() does not neutralize spaces, alphanumerics, equals signs, parentheses, or dots, an attacker can craft an unquoted HTML attribute injection - for example injecting an event handler attribute without quotation marks - that survives sanitization and becomes live markup when the page is served. The CVSS scope-change flag (S:C) reflects that the injected script executes in the security context of the victim's browser session on the affected site rather than within the plugin itself; there is no server-side compromise, and the payload only fires when a user subsequently loads the poisoned page, which is the practical limiting factor on real-world impact.

Know when Mang Board gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI 7.2 HIGH

Unauthenticated network injection bypassing the sanitizer gives PR:N/AC:L; stored XSS executing in other users' browsers justifies S:C with C:L/I:L and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots - none of which are escaped.

Executive ViewAI

Why It Matters

The Mang Board WordPress plugin (all versions through 2.4.3) contains a stored cross-site scripting flaw that allows unauthenticated remote attackers to inject scripts into the 'user_name' parameter, which then execute in the browsers of visitors loading affected pages. Because no vendor-released patch is identified and the flaw can be exploited without authentication, any organization hosting this plugin exposes its site visitors to client-side script execution, potential content tampering, and limited data exposure. Leadership should prioritize inventory and mitigation of affected WordPress installations while the vendor addresses the issue.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing the Mang Board plugin, deploying WAF rules to block unquoted attribute XSS payloads targeting the user_name parameter, enforcing a strict Content Security Policy, escaping or sanitizing stored user_name output, restricting user registration/profile fields, scanning and cleaning stored malicious entries, and monitoring logs for exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.3%

Top 76% exploitable

Prevalence

Low

niche Korean WordPress community-board plugin, limited enterprise footprint

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.