The mangboard WordPress plugin, created by Kitae Park, contains a reflected cross‑site scripting flaw (CWE‑79). A malicious attacker can embed a script in a parameter that is reflected by the plugin during page rendering. If a vulnerable user opens the crafted link, the injected script runs in the victim browser under the site’s origin, enabling session hijacking, phishing, or other client‑side compromises. The impact is confined to the confidentiality and integrity of the victim’s session data but can be amplified if the compromised session extends beyond the site. The flaw is purely an input‑validation weakness and does not allow direct code execution on the server.

Kitae Park’s Mang Board WP WordPress plugin is affected for all versions up to and including 2.4.7. No further version details are provided beyond the maximum affected release number. The plugin is deployed in WordPress sites, so any installation using these versions could be vulnerable.

The CVSS score of 7.1 places this vulnerability in the high severity range, indicating that an attacker can easily exploit it with a simple browser‑based attack vector. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the known exploitation rate is uncertain, but reflected XSS vectors are common and often rapidly abused. The likely attack path is a spam or phishing link containing the malicious parameter that triggers the vulnerable mangboard handler. Once the victim visits, the script executes with the site’s privileges. The exploit only requires the victim to load the malicious URL; no additional credentials or permissions are necessary.