Stored Cross-Site Scripting Vulnerability in Mang Board Plugin for WordPress

CVE-2026-109998

What is CVE-2026-109998?

The Mang Board plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability through the 'content' parameter present in all versions up to and including 2.4.3. This flaw arises from inadequate input sanitization and output escaping processes. Consequently, attackers can exploit this vulnerability to inject arbitrary web scripts into affected pages, which will execute whenever a user visits an injected page. The vulnerability is exacerbated by the accessibility of the wp_ajax_nopriv_mb_template endpoint without authentication, alongside a lack of nonce verification for the content_reply mode. Additionally, since admin-ajax.php returns a Content-Type of text/html, it enables browsers to execute the injected scripts contained in the JSON response body.

References