CVE-2026-96871 is a stored cross-site scripting vulnerability in the Mang Board WordPress plugin. It affects all versions up to 2.4.2 due to improper neutralization of input in the 'data_type' parameter. The flaw allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exploitable on boards configured with default settings (write_level=0 and editor_type=N), which allow guest posting and use the default editor type. This vulnerability is classified under CWE-79.

Successful exploitation enables attackers to execute arbitrary scripts in the context of users visiting the injected pages. This can lead to session hijacking, defacement, or other malicious actions affecting the confidentiality and integrity of user interactions. The vulnerability does not impact availability. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

No official patch or fix is currently documented. Users should check the vendor's advisory for updates. Until a fix is available, it is recommended to disable guest posting (write_level > 0) or change the editor_type setting to a more restrictive configuration to reduce exposure. Implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'data_type' parameter may provide temporary mitigation.