Refine your search

9 vulnerabilities found for Mang Board by kitae-park

CVE-2026-110071 (GCVE-0-2026-110071)
Vulnerability from cvelistv5
Published
2026-10-28 06:45
Modified
2026-10-29 01:41
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110071",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T01:33:53.789429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T01:41:52.280Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027align\u0027 parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer\u0027s browser \u2014 including an administrator previewing a pending post."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T06:45:16.337Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92c90d09-3673-4298-9c54-c3fe1edf6c09?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.5/includes/mb-actions.php#L638"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.5/includes/functions/func.template.php#L214"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.5/includes/mb-actions.php#L632"
        },
        {
          "url": "https://wordpress.org/plugins/mangboard/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.6/includes/mb-actions.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T16:09:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-27T17:40:57.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027align\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-110071",
    "datePublished": "2026-10-28T06:45:16.337Z",
    "dateReserved": "2026-10-13T15:53:07.901Z",
    "dateUpdated": "2026-10-29T01:41:52.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109998 (GCVE-0-2026-109998)
Vulnerability from cvelistv5
Published
2026-10-16 04:27
Modified
2026-10-16 14:39
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:34:48.989979Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:39:05.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "poiri3r"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027content\u0027 parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T04:27:02.743Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe455dc-8138-49d0-97a1-b0dce111d23b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L150"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L177"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L146"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3738899%40mangboard\u0026new=3738899%40mangboard"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T13:53:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T16:10:03.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via \u0027content\u0027 Parameter via content_reply AJAX"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109998",
    "datePublished": "2026-10-16T04:27:02.743Z",
    "dateReserved": "2026-10-13T13:37:41.305Z",
    "dateUpdated": "2026-10-16T14:39:05.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109512 (GCVE-0-2026-109512)
Vulnerability from cvelistv5
Published
2026-10-16 04:26
Modified
2026-10-16 14:39
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109512",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:34:51.990867Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:39:06.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027content\u0027 parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding \u2014 fully reversed at render \u2014 as the sole barrier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T04:26:59.633Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b1e2f1-a287-4b9b-94bb-b860bc4748c3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-filters.php#L75"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-template.php#L503"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L85"
        },
        {
          "url": "https://wordpress.org/plugins/mangboard/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/skin-filters.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T18:17:34.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T16:11:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027content\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109512",
    "datePublished": "2026-10-16T04:26:59.633Z",
    "dateReserved": "2026-10-12T18:02:01.036Z",
    "dateUpdated": "2026-10-16T14:39:06.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109219 (GCVE-0-2026-109219)
Vulnerability from cvelistv5
Published
2026-10-16 04:26
Modified
2026-10-23 18:28
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 2.4.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:51:15.580931Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:09:40.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osman Hussein"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin\u0027s default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T18:28:46.339Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520"
        },
        {
          "url": "https://wordpress.org/plugins/mangboard/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T13:59:01.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T16:07:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via \u0027image_path\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109219",
    "datePublished": "2026-10-16T04:26:58.632Z",
    "dateReserved": "2026-10-12T13:44:07.748Z",
    "dateUpdated": "2026-10-23T18:28:46.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-88043 (GCVE-0-2026-88043)
Vulnerability from cvelistv5
Published
2026-10-15 05:30
Modified
2026-10-15 16:43
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88043",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T10:45:06.533952Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:40.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Ryan Albon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027data_type\u0027 parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T05:30:22.767Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88d62d58-9d06-4a48-b76e-0265892107dc?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3690677/mangboard/trunk/includes/functions/func.api.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-01T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-09-09T20:50:31.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-14T16:45:53.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board WP \u003c= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via \u0027data_type\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-88043",
    "datePublished": "2026-10-15T05:30:22.767Z",
    "dateReserved": "2026-09-09T20:35:12.726Z",
    "dateUpdated": "2026-10-15T16:43:40.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104909 (GCVE-0-2026-104909)
Vulnerability from cvelistv5
Published
2026-10-14 07:43
Modified
2026-10-14 17:38
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Summary
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:38:35.488308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:38:46.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the \u0027\u003cmode\u003e_type (e.g. foo_type)\u0027 parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T07:43:36.462Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbf1cbe0-4740-4d76-a3f5-7d2e1a64d4ee?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/class.board.php#L175"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/class.store.php#L124"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.board.php#L360"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/mangboard.php#L181"
        },
        {
          "url": "https://wordpress.org/plugins/mangboard/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3738898/mangboard/trunk/includes/functions/func.board.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T16:11:58.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T19:23:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.3 - Unauthenticated Local File Inclusion via \u0027\u003cmode\u003e_type\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104909",
    "datePublished": "2026-10-14T07:43:36.462Z",
    "dateReserved": "2026-10-02T15:56:52.111Z",
    "dateUpdated": "2026-10-14T17:38:46.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107751 (GCVE-0-2026-107751)
Vulnerability from cvelistv5
Published
2026-10-14 07:43
Modified
2026-10-15 16:43
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T10:51:53.462624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:48.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leon figueira"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027user_name\u0027 parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots \u2014 none of which are escaped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T07:43:34.349Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72650c92-918a-4486-9365-11bcb6b6741a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/templates/tpl.button.php#L75"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/skin-filters.php#L50"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L146"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/mb-actions.php#L520"
        },
        {
          "url": "https://wordpress.org/plugins/mangboard/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3738898/mangboard/trunk/templates/tpl.button.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T19:02:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T19:22:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via \u0027user_name\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107751",
    "datePublished": "2026-10-14T07:43:34.349Z",
    "dateReserved": "2026-10-08T18:47:21.146Z",
    "dateUpdated": "2026-10-15T16:43:48.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104761 (GCVE-0-2026-104761)
Vulnerability from cvelistv5
Published
2026-10-14 07:43
Modified
2026-10-14 14:28
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T14:27:30.679035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T14:28:13.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027content\u0027 parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T07:43:33.581Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/66a339e2-5744-4a12-8751-6e4662ddc347?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L160"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L156"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L144"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L142"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L78"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L134"
        },
        {
          "url": "https://wordpress.org/plugins/mangboard/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3738898/mangboard/trunk/api/mb-template.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:44:54.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T19:22:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via \u0027content\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104761",
    "datePublished": "2026-10-14T07:43:33.581Z",
    "dateReserved": "2026-10-02T12:29:22.235Z",
    "dateUpdated": "2026-10-14T14:28:13.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96871 (GCVE-0-2026-96871)
Vulnerability from cvelistv5
Published
2026-10-02 07:39
Modified
2026-10-03 15:42
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards.
References
Impacted products
Vendor Product Version
kitae-park Mang Board Version: 0   ≤ 2.4.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:34:40.485595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:49.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mang Board",
          "vendor": "kitae-park",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Ryan Albon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027data_type\u0027 parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T07:39:26.671Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae8d77c-cf52-442a-a273-9bca21db6e32?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.2/includes/skin-filters.php#L75"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.2/includes/functions/func.api.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.2/includes/functions/func.api.php#L133"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.2/includes/mb-actions.php#L520"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3712357%40mangboard\u0026new=3712357%40mangboard"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T18:28:23.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-01T19:16:29.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mang Board \u003c= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via \u0027data_type\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-96871",
    "datePublished": "2026-10-02T07:39:26.671Z",
    "dateReserved": "2026-09-23T18:13:18.413Z",
    "dateUpdated": "2026-10-03T15:42:49.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}