The vulnerability is a stored cross‑site scripting flaw introduced by insufficient input sanitization and output escaping of the 'content' parameter. When an authenticated user with custom-level privileges or higher injects malicious code, the input is persisted and later executed in the context of the target site’s page. This allows an attacker to run arbitrary JavaScript on any user's browser that visits the affected page, facilitating credential theft, session hijacking, and further compromise of site assets.

All installations of the Mang Board WordPress plugin up to and including version 2.4.3 provided by kitae‑park are affected. The flaw exists in the core plugin files where content is processed before rendering, and the issue has been documented in the plugin’s source files for 2.4.3.

The flaw receives a CVSS score of 6.4 and an EPSS score below 1%, implying a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack path requires the attacker to possess an authenticated account with custom or higher privileges, after which the attacker can inject code that will execute for any user who views the compromised content. Because the code runs in the victim’s browser, the impact extends to confidentiality, integrity, and availability of the affected WordPress site.