The Mang Board plugin stores the value of the `data_type` parameter directly in the database without sanitizing or escaping it. As the stored value is later output to pages, an attacker can embed JavaScript that will execute whenever any user visits an affected page. This stored cross‑site scripting allows the attacker to run code in the victim’s browser, enabling session hijacking, defacement, or data theft. The weakness is a typical input validation failure of CWE‑79. The plugin does not require authentication for the injection, making the attack trivial for any external user.

Version 2.4.0 and all earlier releases of the Mang Board WordPress plugin, published by kitae‑park, are affected. The vulnerability exists in the core plugin code that processes the `data_type` parameter in all versions up to and including 2.4.0. Any WordPress site running an affected version is vulnerable until it is updated to a later release.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, so the objective probability is unknown, but because no authentication is required the risk remains high. The vulnerability is not listed in CISA’s KEV catalog, but attackers can exploit it by simply sending a crafted request to the plugin’s endpoint. Once injected, the script runs for all users of the site, potentially exposing sensitive data or compromising session integrity.