Mang Board EUVD-2026-102639

Requires an authenticated account with subscriber-level access or above (PR:L); sites that disable open registration meaningfully limit the attacker pool. The specific exploitation path is a modify request against the 'content' parameter that omits the data_type parameter, which skips the HTMLPurifier sanitization branch entirely and leaves only mbw_htmlspecialchars2 encoding - which is reversed at render time - as the sole barrier. Exploitation is against Mang Board plugin versions up to and including 2.4.4; no victim interaction beyond normally viewing the injected Mang Board page is required, and impact is limited to in-browser script execution (no direct confidentiality-system or availability impact).

This is a moderate-severity stored XSS (CVSS 6.4) that represents a real but not emergency-level priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-reachable, low-complexity exploitation by a low-privileged (subscriber-level) authenticated user, with a scope change reflecting that injected script executes in other users' browser contexts. The low-privilege requirement is significant because WordPress sites that allow open user registration effectively grant any visitor the needed subscriber account, lowering the practical barrier. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this keeps real-world risk below that of unauthenticated or admin-impacting flaws. The description supports the CVSS metrics: the sanitization-bypass detail (omitting data_type to skip the HTMLPurifier branch) is a concrete, credible mechanism, and the AV:N/PR:L/UI:N vector is internally consistent with authenticated stored XSS. Net assessment: a legitimate issue worth patching promptly on affected sites, but not a high-urgency, widely-weaponized threat given the authentication requirement, limited impact (C:L/I:L/A:N), and absence of exploitation signals.

An attacker registers or obtains a subscriber-level account on a WordPress site running Mang Board ≤2.4.4 and submits a modify request to the board's content field with a crafted script payload, deliberately omitting the data_type parameter so the HTMLPurifier sanitization branch is skipped. The payload is stored and then rendered on a Mang Board page, executing in the browser of any user - potentially an administrator - who views that page, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified at time of analysis, but the described sanitization bypass is straightforward to reproduce.