CVE-2026-13334 describes a reflected Cross-Site Scripting vulnerability in the Mang Board WP WordPress plugin affecting all versions up to 2.3.4. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'stag' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows an unauthenticated attacker to perform reflected XSS attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in partial compromise of confidentiality and integrity of user data within the affected web application session. There is no direct impact on system availability. The scope is changed, meaning the vulnerability affects resources beyond the security scope of the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or applying web application firewall (WAF) rules to filter malicious input targeting the 'stag' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.