CVE-2025-3435 is a stored cross-site scripting vulnerability (CWE-79) in the Mang Board WP WordPress plugin. The issue exists in all versions up to and including 1.8.6 due to improper neutralization of input in the board_header and board_footer parameters. An attacker with administrator privileges can inject malicious scripts that persist and execute in the context of users visiting the injected pages. This vulnerability specifically impacts multi-site WordPress installations or those with unfiltered_html disabled, increasing the risk of script injection and potential session hijacking or other script-based attacks.

The vulnerability allows an authenticated administrator to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to limited confidentiality and integrity impacts, such as theft of user credentials or session tokens, or manipulation of page content. The CVSS score of 4.4 reflects a medium severity with network attack vector, high attack complexity, and required privileges. There is no indication of availability impact or known active exploitation in the wild.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the affected parameters (board_header and board_footer) in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply any official patches promptly once released.