Mang Board WP EUVD-2026-42538

The victim must actively navigate to a crafted URL containing the malicious 'stag' parameter value - this mandatory user interaction (UI:R in the CVSS vector) is the primary limiting factor. The attacker requires no credentials or server-side access (PR:N per CVSS), and no special plugin configuration or non-default settings are needed beyond the Mang Board WP plugin being installed and active on the target WordPress instance. Exploitation is further constrained by: (1) the Mang Board WP plugin must be installed and activated; (2) the attacker must successfully social-engineer a target user into clicking the crafted link; (3) browser-level XSS auditors or WAF rules may block delivery in some environments. No authentication, privilege escalation, or server misconfiguration is required on the attacker side - exploitation is limited solely by the social engineering step.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N accurately characterizes the profile: network-accessible with no complexity or privilege prerequisites on the attacker side, but gated by required user interaction (UI:R). The scope change (S:C) reflects that injected scripts execute in the victim's browser context, potentially reaching resources beyond the plugin itself such as WordPress admin session tokens. No EPSS score was included in the input data, so exploitation probability cannot be quantified precisely. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept exploit code was referenced. Real-world risk is moderate and dependent on the attacker's ability to deliver the crafted URL convincingly - targeted phishing of WordPress administrators or editors represents the primary concern. The niche deployment footprint of Mang Board WP limits aggregate attack surface relative to vulnerabilities in WordPress core or widely-installed plugins, making this a lower-priority item for organizations not running this specific plugin.

An attacker identifies a WordPress site running Mang Board WP 2.3.4 or earlier, then constructs a board page URL embedding a JavaScript payload in the 'stag' parameter and delivers it to a site administrator via a phishing email or social engineering. When the administrator clicks the link, the injected script executes in their authenticated browser session, enabling the attacker to steal session cookies, capture credentials, or perform privileged WordPress admin actions on the victim's behalf.