Mang Board CVE-2026-109998

No special conditions beyond having the Mang Board plugin (≤2.4.3) installed and active: the wp_ajax_nopriv_mb_template endpoint is exposed to unauthenticated users by default, nonce verification is not enforced for the content_reply mode, and admin-ajax.php returns Content-Type: text/html which causes browsers to execute injected tags in the JSON response body. The main limiting factor is that this is stored XSS - the payload only executes when a user subsequently accesses the injected page, so impact depends on a victim (ideally a privileged one) viewing the affected content; no authentication, user interaction at injection time, or non-default configuration is required.

This is a genuine, elevated-priority issue for sites running the Mang Board plugin, though not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a network-reachable, low-complexity, fully unauthenticated attack with no user interaction and a changed scope - an unusually favorable profile for an attacker, which is why a 'low/low' impact XSS still reaches 7.2. The description substantiates the PR:N claim with a concrete mechanism: the wp_ajax_nopriv_mb_template endpoint is public, nonce verification is skipped for content_reply mode, and admin-ajax.php returns Content-Type: text/html, so injected markup in the JSON body actually executes. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or automated exploitation - this appears to be a newly disclosed Wordfence-reported flaw rather than one under mass attack. The practical ceiling on impact is that this is stored XSS (C:L/I:L/A:N): it compromises sessions/content in the victim's browser context rather than directly yielding server code execution. Net: a real, easily-triggerable vulnerability worth prompt patching, but current exploitation evidence is absent and real-world blast radius is bounded by the limited product footprint.

An unauthenticated attacker sends a crafted request to admin-ajax.php invoking the wp_ajax_nopriv_mb_template action in content_reply mode, placing a malicious script into the 'content' parameter that bypasses nonce checks and sanitization. Because the response is served as text/html, the stored payload later executes in the browser of any user - including an administrator - who views the injected page, enabling session theft or actions in that user's context. No public exploit code was identified at time of analysis, but the attack path is fully documented in the advisory and trivially reproducible.