The Mang Board plugin for WordPress contains a stored XSS flaw in the handling of the 'align' attribute inside shortcodes. Because the value is not properly sanitized or escaped, an attacker with contributor‑level access (or higher) can submit a short‑form payload that survives the default WordPress filtering. When a user views the post containing the malicious attribute, the browser executes the injected script in the context of the user’s browser session. Based on this capability, it is inferred that an attacker could perform session hijacking, steal cookies, deface content, or otherwise carry out client‑side attacks.

All releases of the Mang Board plugin by kitae‑park up to and including version 2.4.5 are affected. Versions 2.4.6 and later are not confirmed in the provided data to include a fix, so the issue may persist beyond 2.4.5 unless a patch is applied.

The CVSS base score of 6.4 indicates medium severity. The vulnerability requires only contributor‑level or higher privilege, a role that is commonly granted to editors or authors on many WordPress sites. Although the EPSS score is not available, the absence of a listing in the CISA KEV catalog does not diminish the risk, as the flaw remains exploitable. The attack surface is limited to sites running the vulnerable plugin, and the impact is that any authenticated user with the required role can inject scripts that will run in the browsers of all site visitors.