The Mang Board WP plugin contains an insufficiently sanitized ‘stag’ parameter that is reflected in output. An attacker can supply a crafted value in this parameter, causing the plugin to echo it back into the page without escaping. Because the script runs in the victim’s browser context, any unauthenticated user who clicks a malicious link can be the target. While the flaw cannot lead to remote code execution on the host system, it enables a range of client‑side attacks such as session hijacking, defacement, phishing, and arbitrary script injection that could be used to steal credentials or spread malware.

All installations of the Mang Board WP plugin, version 2.3.4 or older, maintained by the vendor kitae‑park, are affected. WordPress sites that have not upgraded beyond 2.3.4 are therefore vulnerable.

With a CVSS score of 6.1 the vulnerability is considered moderate. The EPSS score of less than 1% indicates that the probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Likely attackers will send users a URL containing a malicious payload in the ‘stag’ query string, relying on the victim to click the link. If successful, the reflected script executes with the victim’s privileges, allowing an attacker to steal session information or perform further client‑side actions.