Mang Board CVE-2026-110071

Requires an authenticated account with contributor-level capability or higher on a site running the Mang Board (mangboard) plugin ≤2.4.5, and the ability to submit a post/page containing a Mang Board shortcode. The specific trigger is a JavaScript payload placed in the shortcode's 'align' attribute using no angle brackets, which causes wp_kses_post to leave the attribute intact on save. Execution occurs when any viewer renders the injected page - explicitly including an administrator previewing a pending post - so no victim action beyond normal page viewing is needed. The principal limiting factor is the contributor-access prerequisite: sites that do not grant untrusted users contributor (or higher) posting rights are not exposed to this vector.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world priority is bounded by its access requirement, not its network vector. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms low-complexity network reach but requires authenticated contributor-level privileges (PR:L), which materially narrows the attacker pool to users who already hold a posting account on the site. The scope change (S:C) and the described mechanism - the payload surviving wp_kses_post and firing in an administrator's browser while previewing a pending post - are what give this issue its teeth, since a low-privileged contributor can pivot against a higher-privileged admin session. No EPSS score is provided in the input, and the CVE is not listed in CISA KEV, so there is no signal of active exploitation; the vuln.today decision label is 'this_month', consistent with a real-but-non-emergency issue rather than an act-now crisis. No working exploit reference is present - the references are a Wordfence advisory and WordPress trac source links, not a published PoC. In short: a genuine, credible privilege-boundary-crossing XSS worth patching on a normal cycle, but gated behind contributor access and showing no evidence of widespread or active exploitation.

A contributor-level user on a Mang Board-enabled WordPress site submits a page containing a Mang Board shortcode whose 'align' attribute carries a bracket-free JavaScript payload; because wp_kses_post does not strip the angle-bracket-free attribute value, the malicious shortcode persists through save. When an administrator later previews the pending post, the script executes in the admin's authenticated browser context. No public working exploit code is identified in the input, though the affected source lines are referenced on WordPress trac.