CVE-2026-109512: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in kitae-park Mang Board

CVE-2026-109512 describes a stored Cross-Site Scripting vulnerability in the Mang Board plugin for WordPress, affecting all versions up to and including 2.4.4. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'content' parameter. Authenticated attackers with subscriber-level privileges or higher can exploit this to inject arbitrary scripts. The sanitization bypass occurs when the data_type parameter is omitted in modify requests, which circumvents the HTMLPurifier sanitization branch and relies solely on mbw_htmlspecialchars2 encoding, which can be fully reversed at render time, enabling script execution.

An attacker with subscriber-level access or higher can inject persistent malicious scripts into pages viewed by other users, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability impacts confidentiality and integrity of user interactions but does not affect availability. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting subscriber-level user permissions and avoiding use of the vulnerable plugin version can reduce risk. Applying web application firewalls with XSS detection may provide some mitigation but cannot fully prevent exploitation due to the stored nature of the XSS.