{"id":"CVE-2026-122665","kind":"vulnerability","aliases":["CVE-2026-122665"],"related":[],"title":"Mang Board WP: stored cross-site scripting through 2.4.7 lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Stored XSS.This issue affects Mang Board WP: from n/a through 2.4.7.","summary":"Mang Board WP, a WordPress bulletin board plugin by Kitae Park, fails to neutralize input when generating pages, enabling stored XSS. An attacker can plant script that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Mang Board WP","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["mang-board-wp","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Mang Board WP plugin in the WordPress admin under Plugins; versions through `2.4.7` are listed as affected.","fix":"- Versions through `2.4.7` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:41+00:00","updated_at":"2026-11-09T11:26:41+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T11:26:41Z","model":"claude-haiku-5-5","output":{"fix":"- Versions through `2.4.7` are affected; the sources do not name a fixed version.","reach":"internet","title":"Mang Board WP: stored cross-site scripting through 2.4.7 lets attackers run scripts","impact":"medium","summary":"Mang Board WP, a WordPress bulletin board plugin by Kitae Park, fails to neutralize input when generating pages, enabling stored XSS. An attacker can plant script that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","mang-board-wp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, potentially hijacking admin sessions","analyst_note":"Confirm the fixed version and whether authentication is needed to store the payload, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122665.","how_to_check":"- Check the installed version of the Mang Board WP plugin in the WordPress admin under Plugins; versions through `2.4.7` are listed as affected.\n- unknown","plain_action":"","product_name":"Mang Board WP","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Mang Board WP WordPress plugin at version 2.4.7 or earlier are exposed, since stored input is rendered to visitors. Sites that do not use this plugin can skip it. The sources do not describe the exact configuration required.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000755,"input_tokens":4548,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122665':17A,20A '-2026':16A,19A '2.4.7':10A,99C 'affect':66B,92C 'allow':88C 'anyon':62B 'attack':12A,52B 'board':2A,22A,26B,31B,36B,85C,94C 'browser':60B 'bulletin':35B 'cross':6A,77C 'cross-sit':5A,76C 'cve':15A,18A 'enabl':48B 'fail':41B 'generat':46B,75C 'improp':68C 'input':44B,71C 'issu':91C 'kita':39B,82C 'let':11A 'mang':1A,21A,25B,30B,84C,93C 'mang-board-wp':24B 'mangboard':87C 'n/a':97C 'neutral':43B,69C 'page':47B,67B,74C 'park':40B,83C 'plant':54B 'plugin':37B 'run':13A,57B 'script':8A,14A,55B,79C 'site':7A,78C 'store':4A,49B,89C 'view':64B 'vulner':80C 'web':73C 'wordpress':29B,34B 'wp':3A,23A,27B,32B,86C,95C 'xss':50B 'xss.this':90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mang Board WP WordPress plugin at version 2.4.7 or earlier are exposed, since stored input is rendered to visitors. Sites that do not use this plugin can skip it. The sources do not describe the exact configuration required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["boardwp","mangboardwp"],"ptokens":["board","mang","wp"],"labels":["mangboardwp","medium","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-122665':17A,20A '-2026':16A,19A '2.4.7':10A 'attack':12A 'board':2A,22A 'cross':6A 'cross-sit':5A 'cve':15A,18A 'let':11A 'mang':1A,21A 'run':13A 'script':8A,14A 'site':7A 'store':4A 'wp':3A,23A","search_b":"'affect':66B 'anyon':62B 'attack':52B 'board':26B,31B,36B 'browser':60B 'bulletin':35B 'enabl':48B 'fail':41B 'generat':46B 'input':44B 'kita':39B 'mang':25B,30B 'mang-board-wp':24B 'neutral':43B 'page':47B,67B 'park':40B 'plant':54B 'plugin':37B 'run':57B 'script':55B 'store':49B 'view':64B 'wordpress':29B,34B 'wp':27B,32B 'xss':50B","search_c":"'2.4.7':99C 'affect':92C 'allow':88C 'board':85C,94C 'cross':77C 'cross-sit':76C 'generat':75C 'improp':68C 'input':71C 'issu':91C 'kita':82C 'mang':84C,93C 'mangboard':87C 'n/a':97C 'neutral':69C 'page':74C 'park':83C 'script':79C 'site':78C 'store':89C 'vulner':80C 'web':73C 'wp':86C,95C 'xss.this':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122665","severity":null,"published_at":"2026-11-09T11:17:23+00:00","modified_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}