CVE-2026-122666: WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The vector is network-based, no privileges are required, and exploitation requires user interaction. The vulnerability is reflected XSS, so exploitation would require a victim to interact with attacker-controlled input or a crafted request.

Q: Which installations are affected?

Mang Board WP versions through 2.4.7 are affected. The available information does not state whether any particular WordPress configuration or feature must be enabled.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through 2.4.7.

Affected Software

1 affected component

Kitae Park Mang Board WP<=2.4.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Mang Board WP plugin to a version that resolves this vulnerability.
Fixed in 2.4.8

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vector is network-based, no privileges are required, and exploitation requires user interaction. The vulnerability is reflected XSS, so exploitation would require a victim to interact with attacker-controlled input or a crafted request.

Which installations are affected?