The Mang Board WP plugin is vulnerable to reflected cross‑site scripting due to inadequate sanitization of the 'mp' request parameter. An attacker can embed malicious JavaScript into a crafted URL, which the plugin outputs without proper escaping. When a user follows the link, the script executes in their browser, potentially allowing session hijacking, defacement, or phishing attacks. The weakness is classified as CWE‑79.

All installations of the Mang Board WP WordPress plugin up to and including version 2.3.1 are affected. Users running older releases of the plugin should verify their version and consider upgrading or disabling the plugin entirely.

The vulnerability has a CVSS score of 6.1, indicating a moderate severity, and an EPSS score of less than 1 %, suggesting a low likelihood of exploitation at this time. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be an unauthenticated user visiting a specially crafted URL containing malicious payloads; the impact is confined to the victim’s browser session rather than server‑side compromise. The most probable exploitation scenario involves phishing or link‑bait campaigns targeting unsuspecting users of affected WordPress sites.