The vulnerability originates from the 'user_name' parameter in Mang Board, which is stored without sufficient sanitation or escaping. An attacker can craft malicious values that are persisted and later rendered in pages viewed by other users, enabling arbitrary JavaScript execution. This constitutes Stored Cross‑Site Scripting, allowing attackers to steal sessions, deface content, or spread malware through the victim’s browser.

All installations of the Mang Board WordPress plugin by kitae‑park with a version of 2.4.3 or earlier are affected. This includes every site that has not upgraded beyond that release point.

The CVSS score of 7.2 indicates a high risk of damage, while the EPSS score of less than 1% shows that attacks are currently rare. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires no authentication; an unauthenticated actor can send a crafted request to the plugin’s endpoint, storing the malicious payload for future users. The key weakness is lack of proper input validation, corresponding to CWE‑79.