Live › vulnerability › CVE-2026-110071
Go to dashboardThe Mang Board plugin for WordPress up to and including 2.4.5 fails to sanitize the 'align' shortcode attribute, so stored values survive save. An attacker with contributor access can inject script that runs in any visitor's browser, including an administrator previewing a pending post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the Mang Board WordPress plugin at version 2.4.5 or earlier, where contributor-level or higher users can create or edit posts using its shortcode. Sites without the plugin, or where only trusted editors have accounts, carry less risk. Admins who preview pending posts are a likely target.
No product ranges from the sources yet.
wp plugin get mang-board --field=version2.4.5 or lower2.4.5 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.
This page as .md · .json · in your agent: get_signal("CVE-2026-110071")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.