The Mang Board WP plugin contains a stored XSS flaw due to improper input sanitization when rendering dynamic content. A malicious actor can inject arbitrary scripts that execute in the browsers of privileged users, leading to credential theft or site defacement. The weakness correlates with CWE‑79, where client‑side code is executed with elevated privileges.

The vulnerability affects all installations of the Mang Board WP plugin versions up to 2.4.7. The plugin is distributed by Kitae Park. There is no specific operating‑system or WordPress core version highlighted, so any site running an affected version is potentially compromised.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, so exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The stored XSS can be leveraged by an attacker who can submit content to the plugin, likely requiring authentication or a semi‑trusted input channel within the site. Because the payload runs in the victim’s browser, there is risk of session hijacking or defacement if the attacker can convince users to visit the page.