Mang Board Wp
Monthly
Unauthenticated cross-site scripting in Mang Board WP through version 2.4.6 allows a remote attacker to supply script-bearing content that executes when a victim interacts with a crafted request, affecting WordPress sites running the vulnerable plugin. The CVSS 7.1 vector reflects network reachability with no privileges required but user interaction, scope change, and limited confidentiality and integrity impact; the specific vulnerable parameter or endpoint is not described in the available sources. No public exploit was identified at time of analysis, and the issue is prioritized for remediation this week.
Authenticated arbitrary file upload in the Mang Board WP WordPress plugin through 2.4.4 lets any low-privileged account plant a PHP web shell and execute code on the underlying web server, changing scope beyond WordPress (CVSS 9.9). Exploitation requires a valid PR:L account, so exposure is concentrated on sites that permit untrusted or self-service registration; no public exploit or KEV entry was identified at time of analysis, and no fixed version is specified in the supplied data.
SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.
Cross-Site Request Forgery in the Mang Board WP WordPress plugin (versions ≤ 2.3.8) allows a remote unauthenticated attacker to perform unauthorized admin-level actions by tricking an authenticated site administrator into visiting a malicious page. Because the plugin's state-changing endpoints lack WordPress nonce verification, the victim's browser automatically submits forged requests using the administrator's active session, yielding high confidentiality, integrity, and availability impact over plugin-managed board content. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis.
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.
Reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (all versions through 2.3.4) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'stag' parameter, which executes in the browser of any user who clicks a crafted link. Wordfence's source-level analysis identifies the flaw spanning multiple plugin files including _header.php, func.board.php, and class.store.php. No active exploitation has been identified (not in CISA KEV) and no EPSS score was provided, but the PR:N/UI:R profile makes this a viable phishing-assisted attack against WordPress site administrators and editors.
Unauthenticated cross-site scripting in Mang Board WP through version 2.4.6 allows a remote attacker to supply script-bearing content that executes when a victim interacts with a crafted request, affecting WordPress sites running the vulnerable plugin. The CVSS 7.1 vector reflects network reachability with no privileges required but user interaction, scope change, and limited confidentiality and integrity impact; the specific vulnerable parameter or endpoint is not described in the available sources. No public exploit was identified at time of analysis, and the issue is prioritized for remediation this week.
Authenticated arbitrary file upload in the Mang Board WP WordPress plugin through 2.4.4 lets any low-privileged account plant a PHP web shell and execute code on the underlying web server, changing scope beyond WordPress (CVSS 9.9). Exploitation requires a valid PR:L account, so exposure is concentrated on sites that permit untrusted or self-service registration; no public exploit or KEV entry was identified at time of analysis, and no fixed version is specified in the supplied data.
SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.
Cross-Site Request Forgery in the Mang Board WP WordPress plugin (versions ≤ 2.3.8) allows a remote unauthenticated attacker to perform unauthorized admin-level actions by tricking an authenticated site administrator into visiting a malicious page. Because the plugin's state-changing endpoints lack WordPress nonce verification, the victim's browser automatically submits forged requests using the administrator's active session, yielding high confidentiality, integrity, and availability impact over plugin-managed board content. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis.
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.
Reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (all versions through 2.3.4) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'stag' parameter, which executes in the browser of any user who clicks a crafted link. Wordfence's source-level analysis identifies the flaw spanning multiple plugin files including _header.php, func.board.php, and class.store.php. No active exploitation has been identified (not in CISA KEV) and no EPSS score was provided, but the PR:N/UI:R profile makes this a viable phishing-assisted attack against WordPress site administrators and editors.