Kitae Park

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-109219	Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.	CRITICAL	9.8	0.7%	50	No patch
CVE-2026-111834	Authenticated arbitrary file upload in the Mang Board WP WordPress plugin through 2.4.4 lets any low-privileged account plant a PHP web shell and execute code on the underlying web server, changing scope beyond WordPress (CVSS 9.9). Exploitation requires a valid PR:L account, so exposure is concentrated on sites that permit untrusted or self-service registration; no public exploit or KEV entry was identified at time of analysis, and no fixed version is specified in the supplied data.	CRITICAL	9.9	0.4%	50	No patch
CVE-2026-109698	SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.	CRITICAL	9.3	0.3%	46	No patch
CVE-2026-75977	Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.	HIGH	8.8	0.6%	45	No patch
CVE-2026-84770	Cross-Site Request Forgery in the Mang Board WP WordPress plugin (versions ≤ 2.3.8) allows a remote unauthenticated attacker to perform unauthorized admin-level actions by tricking an authenticated site administrator into visiting a malicious page. Because the plugin's state-changing endpoints lack WordPress nonce verification, the victim's browser automatically submits forged requests using the administrator's active session, yielding high confidentiality, integrity, and availability impact over plugin-managed board content. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis.	HIGH	8.8	0.1%	44	No patch
CVE-2026-104909	Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.	HIGH	8.1	1.0%	42	No patch
CVE-2026-107751	Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.	HIGH	7.2	0.3%	36	No patch
CVE-2026-109998	Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.	HIGH	7.2	0.3%	36	No patch
CVE-2026-96871	Unauthenticated stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.2) lets remote attackers inject arbitrary JavaScript through the unsanitized 'data_type' parameter, which is persisted and then executes in the browser of any user who subsequently loads the affected board page. Exploitation is possible against any board left at the plugin's out-of-the-box defaults (write_level=0 for guest posting and editor_type=N), so newly created boards are vulnerable without any special configuration; the main limiting factor is that a victim must later view the injected page for the script to fire. No public exploit code or confirmed active exploitation has been identified at time of analysis, and while the CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) makes this a genuine elevated-priority issue for sites running the affected plugin, it is not an emergency across the broader internet.	HIGH	7.2	0.2%	36	No patch
CVE-2026-88043	Stored cross-site scripting in Mang Board WP 2.4.0 and earlier allows unauthenticated remote attackers to inject arbitrary web scripts through the 'data_type' parameter, with execution occurring when a victim later views the poisoned page. The issue affects WordPress sites that have the kitae-park Mang Board WP plugin active and reachable on the vulnerable API/code path; sites not running the plugin are unaffected. No public exploit code or CISA KEV entry is identified at time of analysis, and the CVSS 3.1 score of 7.2 reflects a moderate-priority issue that should be patched but does not rise to emergency status.	HIGH	7.2	0.2%	36	No patch
CVE-2026-61974	Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.	HIGH	7.1	0.2%	36	No patch
CVE-2026-94176	Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.	HIGH	7.1	0.2%	36	No patch
CVE-2026-104761	Stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.3) allows an authenticated user holding 'custom-level' access or above to inject arbitrary JavaScript through the 'content' parameter, which is then rendered without adequate sanitization or output escaping. The injected script is stored server-side and executes in the browser session of any user or administrator who later views the affected page, which is why the CVSS vector scores a scope change (S:C) with low confidentiality and integrity impact (6.4 overall). Exploitation requires a valid low-privileged account on a site that grants custom-level roles, and no public exploit code was identified at time of analysis; this is not listed on CISA KEV and should be handled as a routine patch-management item rather than an emergency.	MEDIUM	6.4	0.3%	32	No patch
CVE-2026-109512	Stored cross-site scripting in the Mang Board WordPress plugin (versions up to and including 2.4.4) allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts into pages via the 'content' parameter by omitting the data_type parameter in a modify request, which bypasses the HTMLPurifier sanitization branch and leaves only reversible mbw_htmlspecialchars2 encoding as a barrier. Exploitation requires only that a victim view the injected Mang Board page, resulting in in-browser script execution with limited confidentiality and integrity impact (CVSS 6.4); this is a moderate-severity issue representing a real but not emergency-level priority, and no public exploit identified at time of analysis. Sites that disable open registration meaningfully limit the attacker pool, and exploitation is specific to versions up to and including 2.4.4.	MEDIUM	6.4	0.2%	32	No patch
CVE-2026-110071	Stored cross-site scripting in the Mang Board WordPress plugin through 2.4.5 lets authenticated users with contributor-level access or higher inject scripts through a shortcode's align attribute, which then execute for any viewer of the affected page, including an administrator previewing a pending post. The payload avoids angle brackets so wp_kses_post leaves the shortcode intact on save; the CVSS 3.1 score is 6.4, and no public exploit code has been identified at the time of analysis.	MEDIUM	6.4	0.2%	32	No patch

CVE-2026-109219

Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.

CRITICAL

9.8

0.7%

50

No patch

CVE-2026-111834

Authenticated arbitrary file upload in the Mang Board WP WordPress plugin through 2.4.4 lets any low-privileged account plant a PHP web shell and execute code on the underlying web server, changing scope beyond WordPress (CVSS 9.9). Exploitation requires a valid PR:L account, so exposure is concentrated on sites that permit untrusted or self-service registration; no public exploit or KEV entry was identified at time of analysis, and no fixed version is specified in the supplied data.

CRITICAL

9.9

0.4%

50

No patch

CVE-2026-109698

SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.

CRITICAL

9.3

0.3%

46

No patch

CVE-2026-75977

Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.

HIGH

8.8

0.6%

45

No patch

CVE-2026-84770

Cross-Site Request Forgery in the Mang Board WP WordPress plugin (versions ≤ 2.3.8) allows a remote unauthenticated attacker to perform unauthorized admin-level actions by tricking an authenticated site administrator into visiting a malicious page. Because the plugin's state-changing endpoints lack WordPress nonce verification, the victim's browser automatically submits forged requests using the administrator's active session, yielding high confidentiality, integrity, and availability impact over plugin-managed board content. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis.

HIGH

8.8

0.1%

44

No patch

CVE-2026-104909

Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.

HIGH

8.1

1.0%

42

No patch

CVE-2026-107751

Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.

HIGH

7.2

0.3%

36

No patch

CVE-2026-109998

Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.

HIGH

7.2

0.3%

36

No patch

CVE-2026-96871

Unauthenticated stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.2) lets remote attackers inject arbitrary JavaScript through the unsanitized 'data_type' parameter, which is persisted and then executes in the browser of any user who subsequently loads the affected board page. Exploitation is possible against any board left at the plugin's out-of-the-box defaults (write_level=0 for guest posting and editor_type=N), so newly created boards are vulnerable without any special configuration; the main limiting factor is that a victim must later view the injected page for the script to fire. No public exploit code or confirmed active exploitation has been identified at time of analysis, and while the CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) makes this a genuine elevated-priority issue for sites running the affected plugin, it is not an emergency across the broader internet.

HIGH

7.2

0.2%

36

No patch

CVE-2026-88043

Stored cross-site scripting in Mang Board WP 2.4.0 and earlier allows unauthenticated remote attackers to inject arbitrary web scripts through the 'data_type' parameter, with execution occurring when a victim later views the poisoned page. The issue affects WordPress sites that have the kitae-park Mang Board WP plugin active and reachable on the vulnerable API/code path; sites not running the plugin are unaffected. No public exploit code or CISA KEV entry is identified at time of analysis, and the CVSS 3.1 score of 7.2 reflects a moderate-priority issue that should be patched but does not rise to emergency status.

HIGH

7.2

0.2%

36

No patch

CVE-2026-61974

Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.

HIGH

7.1

0.2%

36

No patch

CVE-2026-94176

Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.

HIGH

7.1

0.2%

36

No patch

CVE-2026-104761

Stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.3) allows an authenticated user holding 'custom-level' access or above to inject arbitrary JavaScript through the 'content' parameter, which is then rendered without adequate sanitization or output escaping. The injected script is stored server-side and executes in the browser session of any user or administrator who later views the affected page, which is why the CVSS vector scores a scope change (S:C) with low confidentiality and integrity impact (6.4 overall). Exploitation requires a valid low-privileged account on a site that grants custom-level roles, and no public exploit code was identified at time of analysis; this is not listed on CISA KEV and should be handled as a routine patch-management item rather than an emergency.

MEDIUM

6.4

0.3%

32

No patch

CVE-2026-109512

Stored cross-site scripting in the Mang Board WordPress plugin (versions up to and including 2.4.4) allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts into pages via the 'content' parameter by omitting the data_type parameter in a modify request, which bypasses the HTMLPurifier sanitization branch and leaves only reversible mbw_htmlspecialchars2 encoding as a barrier. Exploitation requires only that a victim view the injected Mang Board page, resulting in in-browser script execution with limited confidentiality and integrity impact (CVSS 6.4); this is a moderate-severity issue representing a real but not emergency-level priority, and no public exploit identified at time of analysis. Sites that disable open registration meaningfully limit the attacker pool, and exploitation is specific to versions up to and including 2.4.4.

MEDIUM

6.4

0.2%

32

No patch

CVE-2026-110071

Stored cross-site scripting in the Mang Board WordPress plugin through 2.4.5 lets authenticated users with contributor-level access or higher inject scripts through a shortcode's align attribute, which then execute for any viewer of the affected page, including an administrator previewing a pending post. The payload avoids angle brackets so wp_kses_post leaves the shortcode intact on save; the CVSS 3.1 score is 6.4, and no public exploit code has been identified at the time of analysis.

MEDIUM

6.4

0.2%

32

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (4)

Top Risky CVEs