Mang Board WP EUVD-2026-85475

Exploitation requires the Mang Board WP plugin (version 2.4.1 or earlier) to be installed and active on a WordPress site, and requires a victim to click an attacker-crafted URL (UI:R) carrying the reflected XSS payload - it cannot be triggered server-side or automatically. No authentication is required of the attacker (PR:N). The primary limiting factor is the mandatory victim interaction, which restricts this to targeted/social-engineering delivery rather than automated mass exploitation; impact is further limited to whatever the victim's browser session can perform.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) describes an unauthenticated, network-reachable reflected XSS whose severity is inflated by S:C (scope change, standard for XSS crossing into the browser's trust context) and by assigning Low to all three impact metrics. The real gating factor is UI:R: exploitation requires a victim to click an attacker-crafted link, so it is not automatable mass-exploitation. Patchstack (the reporter) is a reputable WordPress-vulnerability source, which lends confidence to the classification, but there is NO EPSS score, NO CISA KEV listing, and NO public POC provided in the input - so all exploitation-probability signals are absent rather than high. I assess the A:L (availability) impact as generous for a reflected XSS; A:N is more defensible, which would lower the base score to roughly 6.1. No SSVC decision data was supplied. Net: a real, valid vulnerability worth patching in a maintenance window, but not an emergency and not evidence of active exploitation.

An attacker crafts a URL to a vulnerable Mang Board WP page (<=2.4.1) with a malicious script payload in a reflected parameter and delivers it via phishing, forum post, or malicious link. When a logged-in site user or administrator clicks the link, the injected JavaScript executes in their browser session, enabling session-token theft, actions on their behalf, or content defacement. No public exploit code is identified at time of analysis, and success depends on the victim clicking the crafted link.