Mang Board WP EUVD-2026-101845

Requires the Mang Board WP plugin (vendor kitae-park) to be installed and active at version 2.4.0 or earlier, with the code path handling the 'data_type' parameter reachable. Per the CVSS vector (PR:N), exploitation is unauthenticated and needs no special privileges or non-default configuration at the injection stage. The limiting factor is that the injected script only fires when a user - ideally a privileged one - later accesses the page containing the stored payload, so impact depends on a victim rendering the poisoned content; sites not running this specific plugin are entirely unaffected.

This is a moderate-priority issue that should be patched but does not rise to emergency status. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated stored XSS with a scope change and low confidentiality/integrity impact - consistent with a self-propagating client-side injection in a WordPress plugin. No EPSS score, KEV listing, or POC reference is present in the input, so there is no signal of active or imminent mass exploitation; this is a high-CVSS finding without corroborating exploitation-probability data. One notable tension: the CVSS vector sets UI:N, yet the description states the payload 'executes whenever a user accesses an injected page,' which implies victim interaction (visiting the page) - the UI:N scoring reflects that no interaction is needed at the injection step, but defenders should understand that payload execution depends on a victim rendering the page. Overall this reads as a genuine but bounded web-app vulnerability whose real-world urgency is tempered by the plugin's limited deployment footprint rather than by any weakness in the vulnerability itself.

An unauthenticated attacker submits a crafted value in the 'data_type' parameter that is stored by the Mang Board WP plugin and later rendered into a page without proper sanitization or output escaping. When any user - including an administrator - subsequently views the affected page, the attacker's JavaScript executes in that user's browser session, enabling session/cookie theft or actions in the victim's authenticated context. No public exploit code is identified in the provided data, though the vendor patch changeset reveals the vulnerable code path.