Mang Board WP EUVD-2026-57974

No authentication is required to submit the malicious payload - the CVSS vector PR:N confirms the injection point is publicly accessible without credentials. The limiting factor is UI:R: a victim user must actively load or interact with the page containing the injected content, meaning the attacker cannot trigger execution unilaterally. Exploitation is most impactful when the victim is an authenticated WordPress administrator, as their session token carries elevated privileges. The vulnerability is scoped to WordPress installations with the Mang Board WP plugin active and at version 2.3.4 or below; sites not running this plugin are unaffected. No special server configuration, non-default setting, or specific PHP version is indicated as required.

The CVSS 7.1 score is driven primarily by network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and scope change (S:C), though user interaction (UI:R) is necessary - meaning a victim must load a page containing the injected payload. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been confirmed, reducing immediate mass-exploitation concern. Even a mid-sized municipal IT team in bytom running a community WordPress board would find the practical risk meaningful if any administrative users browse the affected board pages while authenticated, since XSS with scope change can enable full session takeover. The real-world priority is moderate: the attack is easy to execute but requires victim interaction and is limited to sites running this specific niche plugin.

An unauthenticated attacker identifies a WordPress site running Mang Board WP 2.3.4 or earlier and submits a crafted payload containing a malicious script tag through a publicly accessible board input - such as a post field or comment - without logging in. The unsanitized payload is stored or reflected back in a page that an authenticated administrator or regular user subsequently visits, causing the script to execute in their browser, exfiltrating their session cookie to an attacker-controlled server. No confirmed public proof-of-concept exists, but the low-complexity attack path makes independent exploitation straightforward for any attacker familiar with XSS techniques.