Stored Cross-Site Scripting in Mang Board Plugin for WordPress

CVE-2026-107751

What is CVE-2026-107751?

The Mang Board plugin for WordPress has a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts on compromised pages. This issue arises due to insufficient input sanitization and output escaping related to the 'user_name' parameter. With the exploit relying on unquoted HTML attribute syntax, attackers can craft malicious payloads using spaces, alphanumerics, and specific characters. As a result, whenever a user accesses the affected page, the injected scripts may execute, posing significant security risks to both users and website integrity.

References