The Mang Board WordPress plugin up to version 2.4.4 allows authenticated users with subscriber rights or higher to store malicious scripts via the 'content' field because the input is insufficiently sanitized and the output escaping is incomplete; this meets the criteria for stored cross‑site scripting as defined by CWE‑79. An attacker who leverages this flaw can cause arbitrary JavaScript to run in the browsers of any user who views the affected page, enabling cookie theft, session hijacking, defacement, or the execution of further malicious payloads rendered in the victim’s context.

WordPress sites that install the Mang Board plugin version 2.4.4 or earlier, developed by the vendor kitae‑park. The vulnerability is present in all releases up to and including 2.4.4; no later versions are known to contain the flaw.

The CVSS score of 6.4 indicates moderate severity; the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires an authenticated session with at least subscriber privileges, but the vendor’s code allows bypass of data_type checks during modification requests, enabling an authenticated attacker to inject scripts that survive the output escaping routine and are stored for subsequent page rendering. Consequently, while the vulnerability does not allow arbitrary code execution, it poses significant risk due to the widespread impact on all visitors to affected pages.