{"id":"CVE-2026-116847","kind":"vulnerability","aliases":["CVE-2026-116847"],"related":[],"title":"Mang Board WP: unauthenticated cross-site scripting in plugin up to 2.4.6","description":"Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.","summary":"Mang Board WP, a WordPress plugin, has an unauthenticated cross-site scripting flaw in versions up to and including 2.4.6. An attacker can get script injected into pages that visitors load, which can run in their browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mang-board-wp","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Mang Board WP version in the WordPress admin plugin list or the plugin's readme.txt, for example with `wp plugin get mang-board-wp --field=version` if WP-CLI is available.","fix":"- Move to a version later than `2.4.6`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T19:18:14+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:10+00:00","updated_at":"2026-10-30T19:26:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:10Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `2.4.6`; the sources do not name the fixed version.","reach":"internet","title":"Mang Board WP: unauthenticated cross-site scripting in plugin up to 2.4.6","impact":"medium","summary":"Mang Board WP, a WordPress plugin, has an unauthenticated cross-site scripting flaw in versions up to and including 2.4.6. An attacker can get script injected into pages that visitors load, which can run in their browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mang-board-wp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers on the site","analyst_note":"Find the fixed plugin version and the vulnerable parameter or endpoint at https://nvd.nist.gov/vuln/detail/CVE-2026-116847 or the plugin's WordPress.org page.","how_to_check":"- Check the installed Mang Board WP version in the WordPress admin plugin list or the plugin's readme.txt, for example with `wp plugin get mang-board-wp --field=version` if WP-CLI is available.\n- unknown for any other check; the sources do not say which setting or path is exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Mang Board WP WordPress plugin at version 2.4.6 or earlier are exposed, since the flaw needs no login. The sources do not say which plugin features or pages are reachable, so unknown whether a default install is affected. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4068,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116847':16A,19A '-2026':15A,18A '2.4.6':13A,46B,73C 'attack':48B 'board':2A,22B,27B,71C 'browser':63B 'cross':6A,36B,65C 'cross-sit':5A,35B 'cve':14A,17A 'flaw':39B 'get':50B 'includ':45B 'inject':52B 'load':57B 'mang':1A,21B,26B,70C 'mang-board-wp':20B 'packag':24B 'page':54B 'plugin':10A,31B 'run':60B 'script':8A,38B,51B,67C 'site':7A,37B,66C 'unauthent':4A,34B,64C 'version':41B,74C 'visitor':56B 'wordpress':25B,30B 'wp':3A,23B,28B,72C 'xss':68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mang Board WP WordPress plugin at version 2.4.6 or earlier are exposed, since the flaw needs no login. The sources do not say which plugin features or pages are reachable, so unknown whether a default install is affected. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116847","severity":null,"published_at":"2026-10-30T19:18:14+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}