CVE-2026-110071: Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wpksespost leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They can place a malicious Mang Board shortcode attribute in content they are permitted to submit.
Who is exposed when malicious content is viewed?
Any user who accesses an injected page can have the stored script execute in their browser. This includes an administrator who previews a pending post.
Are affected sites vulnerable through ordinary post submission?
Yes. The malicious payload can survive post submission because it contains no angle brackets, allowing it to remain intact after wp_kses_post processing and execute when the page is viewed.