EUVD-2026-57974
GHSA-r3jr-rmx6-fqgv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-accessible XSS injection requires no auth (PR:N) but demands victim page load (UI:R); scope change applies as script executes in browser context; availability impact assessed as None - XSS does not directly disrupt service.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
AnalysisAI
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required to submit the malicious payload - the CVSS vector PR:N confirms the injection point is publicly accessible without credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score is driven primarily by network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and scope change (S:C), though user interaction (UI:R) is necessary - meaning a victim must load a page containing the injected payload. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Mang Board WP 2.3.4 or earlier and submits a crafted payload containing a malicious script tag through a publicly accessible board input - such as a post field or comment - without logging in. The unsanitized payload is stored or reflected back in a page that an authenticated administrator or regular user subsequently visits, causing the script to execute in their browser, exfiltrating their session cookie to an attacker-controlled server. … |
| Remediation | Patch available per vendor advisory - update the Mang Board WP plugin beyond version 2.3.4 via the WordPress plugin dashboard or by downloading from the plugin repository; however, an exact patched release version is not independently confirmed from the available data (the Patchstack advisory at the URL above should be consulted for the confirmed fixed version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations and identify which are running Mang Board WP versions 2.3.4 or earlier; alert affected site owners immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mang Board Wp
View allCookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge admin
Reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (all versions through 2.3.4) allows unauthenticated
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today