CVE-2026-104761: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in kitae-park Mang Board

CVE-2026-104761 describes a stored Cross-Site Scripting vulnerability in the Mang Board WordPress plugin. The flaw exists in all versions up to 2.4.3 due to improper neutralization of input in the 'content' parameter. Authenticated attackers with custom-level privileges or above can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, indicating a medium severity level.

Successful exploitation allows attackers with authenticated access to inject and execute arbitrary scripts in the browsers of users who visit the compromised pages. This can lead to information disclosure and integrity impacts but does not affect availability. The vulnerability requires authenticated access with custom-level permissions or higher, limiting the attack surface.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with custom-level permissions and above, and consider monitoring for suspicious activity related to script injection.