Mang Board WP CVE-2026-116847

Exploitation requires a victim to interact with an attacker-supplied request (UI:R) - such as clicking a crafted link or loading a malicious page that reaches the vulnerable Mang Board WP input on a site running version 2.4.6 or earlier. No attacker authentication is needed (PR:N), so any remote unauthenticated attacker can craft the payload, but the required user interaction is the key limiting factor: without a victim trigger, the flaw does not fire. The specific vulnerable parameter, endpoint, or configuration is not described in the available sources, so it is unverified whether a non-default setting is needed; the advisory describes it only as unauthenticated XSS affecting versions <= 2.4.6.

This is a moderate-severity reflected/unauthenticated Cross-Site Scripting flaw (CWE-79) in the Mang Board WP plugin, carrying a CVSS 7.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity and lack of required privileges (PR:N) make it reachable by remote unauthenticated attackers, but the UI:R metric means a victim must be induced to interact (e.g., click a crafted link or visit a malicious page), which meaningfully limits mass, hands-off exploitation. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than purely on the server. Exploitation signals are weak-to-absent: no CISA KEV listing, no EPSS probability supplied, and no confirmed working exploit code - only a Patchstack database advisory reference. The vuln.today decision label is 'this_week', indicating a near-term but non-emergency patching priority rather than active-exploitation urgency. Net assessment: a genuine issue worth remediating on a normal cycle, but currently a high-CVSS-for-its-class issue without evidence of real-world exploitation, and its impact is capped by the user-interaction requirement and the typical limited (Low) confidentiality/integrity impact of XSS.

An attacker crafts a malicious link or page that injects script through the vulnerable Mang Board WP input and sends it to a victim (e.g., a logged-in site administrator or visitor). When the victim interacts with the crafted request (UI:R), the script executes in their browser in the site's context, allowing session/cookie theft or actions on their behalf. No authentication is required of the attacker, but no confirmed working exploit code is identified at time of analysis - only a Patchstack advisory reference exists.