The MangBoard WP plugin is vulnerable to stored cross‑site scripting via its board_header and board_footer parameters. An administrator‑level user can inject arbitrary web scripts that are rendered on any page that loads the manipulated content, potentially enabling session hijacking, defacement, or other client‑side attacks. The weakness is a classic input validation and output escaping flaw (CWE‑79).

All installs of the kitae‑park MangBoard WP plugin up to and including version 1.8.6 are affected. The issue exists only on WordPress multisite sites where the unfiltered_html option has been disabled.

The CVSS score of 4.4 indicates a moderate risk level, and the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not present in the CISA KEV catalog. Exploitation requires an authenticated administrator with access to the plugin’s settings on a multisite installation where unfiltered_html is off. Under those conditions an attacker can inject malicious scripts that will execute automatically when users visit the affected pages.