An unauthenticated cross‑site scripting vulnerability exists in the Mang Board WP WordPress plugin through version 2.4.6. The flaw allows an attacker to inject arbitrary client‑side script into pages that the plugin renders, potentially compromising the session of any visitor who accesses the affected content. This can lead to cookie theft, defacement, or the execution of malicious operations in the context of the authenticated user. The weakness is a classic input‑validation failure, identified as CWE‑79.

The vulnerability affects the WordPress plugin Mang Board WP, developed by Kitae Park, for all installations running version 2.4.6 or earlier.

The CVSS score of 7.1 indicates medium‑to‑high severity, and the attack can be performed without authentication, making the vulnerability reachable by a wide range of actors. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited in the wild yet. Nonetheless, attackers can exploit the flaw via injection into any user‑visible plugin output, so sites should treat it as a pressing risk until the plugin is updated.