CVE-2026-96871: Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default writelevel=0 (guest posting) and editortype=N settings, which are the out-of-the-box defaults for newly created boards.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed by default?
Boards using the default write_level=0 and editor_type=N settings are exploitable. These are the out-of-the-box settings for newly created boards, allowing guest posting without authentication.
What does an attacker need to exploit this issue?
An attacker does not need an account, privileges, or user interaction to submit the malicious content. They need access to a board that permits guest posting with the affected default configuration.
When does the injected script execute?
The script is stored in board content and executes when a user accesses the injected page. This can affect users who view the compromised board page after the attacker submits the payload.
What configuration change can reduce exposure if updates cannot be applied immediately?
Disable guest posting by changing write_level from 0, and avoid the affected editor_type=N configuration. This removes the stated default conditions under which unauthenticated exploitation is possible.