Stored Cross-Site Scripting Vulnerability in Mang Board Plugin for WordPress
CVE-2026-110071

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Mang Board
Vendor
CVE Published:
28 October 2026

What is CVE-2026-110071?

The Mang Board plugin for WordPress presents a vulnerability due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to execute arbitrary web scripts. This vulnerability is exploited through the 'align' parameter, enabling attackers to inject malicious scripts in pages that execute upon access. Even though the shortcode may remain intact due to restrictions in wp_kses_post, the harmful scripts can still affect users' browsers, including administrators viewing pending posts.

Affected Version(s)

Mang Board 0 <= 2.4.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mangboard/tags...
https://plugins.trac.wordpress.org/browser/mangboard/tags...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.