Stored Cross-Site Scripting in Mang Board Plugin for WordPress

CVE-2026-109512

What is CVE-2026-109512?

The Mang Board plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'content' parameter in all versions up to 2.4.4. This vulnerability arises from inadequate input sanitization and output escaping, enabling authenticated attackers with subscriber-level access or higher to inject malicious web scripts into pages that execute when any user accesses the compromised page. Additionally, the vulnerability is exacerbated by the option to omit the data_type parameter in modification requests, thus bypassing the HTMLPurifier sanitation step entirely. As a result, only a minimal encoding function remains in place, which can easily be reversed during page rendering, leading to serious security implications.

References