EUVD-2026-42538
GHSA-pm92-5rp3-r8mg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring no privileges but mandatory victim click; scope changes to victim browser enabling limited confidentiality and integrity impact with no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (all versions through 2.3.4) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'stag' parameter, which executes in the browser of any user who clicks a crafted link. Wordfence's source-level analysis identifies the flaw spanning multiple plugin files including _header.php, func.board.php, and class.store.php. No active exploitation has been identified (not in CISA KEV) and no EPSS score was provided, but the PR:N/UI:R profile makes this a viable phishing-assisted attack against WordPress site administrators and editors.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this class of flaw: user-supplied input is reflected back into the HTTP response without sufficient sanitization or output encoding. The 'stag' parameter is processed across multiple code paths - skins/bbs_basic/_header.php at line 26, includes/functions/func.board.php at line 297, and includes/class.store.php at lines 110 and 122 - indicating the parameter's value flows through several rendering contexts within the plugin without being sanitized at any stage. The affected product is identified by CPE cpe:2.3:a:kitae-park:mang_board_wp:*:*:*:*:*:*:*:* as the Mang Board WP bulletin board plugin developed by kitae-park, installed as a WordPress extension. Reflected XSS is distinct from stored XSS in that the payload is not persisted server-side; it must be delivered via a crafted URL on each exploitation attempt, requiring social engineering of the victim.
RemediationAI
Update the Mang Board WP plugin beyond version 2.3.4; a fix is available in WordPress SVN changeset 3598739 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3598739%40mangboard&new=3598739%40mangboard), though the exact version number of the released patched build is not stated in available input data and should be verified in the WordPress plugin directory or via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0f42b2be-2a7d-470a-896d-6148e31e4cce before updating. As an interim workaround, the plugin can be deactivated entirely - this eliminates all attack surface with the sole trade-off of losing bulletin board functionality. Restricting board pages to authenticated users via WordPress role controls reduces exposure but does not eliminate the vulnerability, as lower-privileged authenticated users could still be targeted via the same phishing vector. A WAF rule blocking unsanitized script content in the 'stag' parameter is a viable compensating control if immediate plugin update is not feasible, though WAF rule maintenance carries ongoing operational cost.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today