Cpe:2.3:a:mang_board:mang_board:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amang_boardmang_boardwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 06:35:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in Mang Board WP Pluginhttps://feed.craftedsignal.io/briefs/2026-10-mang-board-xss/Thu, 15 Oct 2026 06:35:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mang-board-xss/The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'data_type' parameter in all versions up to and including 2.4.0. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied data. An unauthenticated attacker can inject arbitrary web scripts into the application, which are then stored by the server. When an unsuspecting user, such as an administrator, views the affected page, the malicious script executes within the context of the user's session. This flaw could lead to session hijacking, unauthorized administrative actions, or the redirection of users to malicious websites.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the compromised page. This can result in complete account takeover if an administrator views the injected content, leading to a full compromise of the WordPress installation and its associated database.

Recommendation

Update the Mang Board WP plugin to a version released after 2.4.0 that incorporates proper input sanitization and output escaping for the 'data_type' parameter. If an update is unavailable, disable the plugin until a vendor patch is applied.

]]>highadvisoryweb-vulnerabilityxsswordpress