CVE-2026-13334 describes a reflected Cross-Site Scripting (CWE-79) vulnerability in the Mang Board WP WordPress plugin by kitae-park. The issue exists in the handling of the 'stag' parameter, which lacks proper input sanitization and output escaping, enabling unauthenticated attackers to inject malicious scripts. This vulnerability affects all versions up to and including 2.3.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser when the victim interacts with a crafted link. This can lead to partial confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect system availability. The vulnerability requires user interaction and is exploitable remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the Mang Board WP plugin or applying custom input validation and output escaping for the 'stag' parameter to mitigate exploitation risk.