Login Request a demo
Medium severity · published Jul 9, 2026
CVE-2026-13334
Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Mang Board WP · kitae-park
through 2.3.4 · source: vendor
Affected product
MB
Mang Board WP
kitae-park
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13334
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13334
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.4/includes/class.store.php#L110
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.4/includes/class.store.php#L122
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.4/includes/functions/func.board.php#L297
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.4/skins/bbs_basic/_header.php#L26
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?reponame=&old=3598739%40mangboard&new=3598739%40mangboard
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0f42b2be-2a7d-470a-896d-6148e31e4cce?source=cve
More from Mang Board WP
9.9
CVE-2026-111834
WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability
9.3
CVE-2026-109698
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
8.8
CVE-2026-84770
WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
8.8
CVE-2026-75977
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
7.1
CVE-2026-94176
WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability