CVE-2026-107751: Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbwhtmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
No authentication or special privileges are required. An attacker can submit a crafted value through the user_name parameter to store script content.
Which installations are affected?
All Mang Board versions up to and including 2.4.3 are affected. The issue is in the Mang Board plugin for WordPress.
When does the injected script run?
The script runs when a user accesses a page containing the injected content. Because it is stored cross-site scripting, the attacker does not need to be present when the victim views that page.
Why does the existing sanitizer not prevent this attack?
The save-time mbw_htmlspecialchars2() sanitizer does not escape the unquoted HTML attribute syntax used by the payload. The exploit can use spaces, alphanumeric characters, and characters including equals signs, parentheses, and dots.