CVE-2026-61974 describes an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Mang Board WP versions up to 2.3.4. The vulnerability allows remote attackers with no privileges to inject scripts that execute with user interaction, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with low confidentiality, integrity, and availability impacts.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable component, potentially leading to partial disclosure of information, modification of data, or disruption of service. The vulnerability does not require authentication but does require user interaction to trigger the malicious script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's announcements for updates and apply any official patches once available.