Mang Board CVE-2026-96871

Exploitable without authentication against any board using the out-of-the-box defaults write_level=0 (guest posting enabled) and editor_type=N, which are the defaults for newly created boards - so no non-default setup is needed to be vulnerable. The specific injection point is the 'data_type' parameter, which lacks input sanitization and output escaping. Limiting factors: exploitation requires a board reachable by the attacker and still configured with guest posting (an administrator who disabled guest posting via write_level or switched editor_type away from N reduces exposure), and impact depends on a victim subsequently loading the injected page for the stored script to fire.

This is a genuine, elevated-priority issue for sites running the affected plugin, though not an emergency across the broader internet. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes network-reachable, low-complexity, unauthenticated exploitation with a scope change - consistent with stored XSS where injected script executes in other users' browser contexts. The reinforcing signal is strong on the technical side: the description confirms exploitation works against the out-of-the-box default configuration (write_level=0 guest posting, editor_type=N), meaning no victim-side misconfiguration is required to be vulnerable. However, several real-world-risk signals are MISSING from the input and must not be fabricated: no EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The overall CVSS of 7.2 (High) is driven largely by PR:N plus scope change; the actual impact is limited (C:L/I:L/A:N), i.e., script injection rather than server compromise. Net: treat as a prioritized patch for sites running Mang Board, but the limited real-world deployment footprint of this niche plugin and the absence of active-exploitation evidence argue against treating it as an internet-wide incident.

An unauthenticated attacker visits a public Mang Board board left at its default guest-posting settings and submits a post whose 'data_type' parameter carries a malicious script payload that is stored unsanitized. When any user - including an administrator - later views the injected board page, the script executes in their browser session, enabling session/cookie theft, forced actions, or redirection. No public exploit code is referenced in the provided data, so this scenario is inferred from the CVSS vector (network, low complexity, no privileges, no user interaction) and the stated default-configuration exposure.