Based on the description, the likely attack vector is through the publicly exposed wp_ajax_nopriv_mb_template AJAX endpoint, allowing unauthenticated users to submit malicious 'content' that is stored and later rendered. The Mang Board WordPress plugin allows such attackers to store scripts in the 'content' field, which are then embedded in the JSON response from the endpoint. Because the response is sent with Content-Type: text/html, browsers interpret the embedded code and execute it whenever a normal user loads the affected page, leading to arbitrary script execution on the victim’s browser. This flaw is a classic stored cross‑site scripting vulnerability (CWE-79) that can compromise user credentials, deface content, or serve phishing payloads.

All installations of the Mang Board plugin by kitae-park running version 2.4.3 or any older release are affected. The vulnerability exists in all releases up to and including 2.4.3, as the handler for the 'content' parameter lacks proper sanitization and escaping across those versions.

The flaw carries a CVSS score of 7.2 and has an EPSS score of < 1 %, indicating a low but nonzero probability of exploitation. The lack of authentication checks on the wp_ajax_nopriv_mb_template endpoint suggests that exploitation is readily achievable for any Internet‑facing WordPress site that does not restrict this AJAX action. Based on the description, it is inferred that the attack vector is through the publicly exposed AJAX action, enabling attackers to inject scripts that run inside the victim’s browser context, potentially stealing session cookies or redirecting to malicious sites. The vulnerability is not currently listed in the CISA KEV catalog, indicating there are no known active exploits, but the high impact of stored XSS warrants immediate attention.