CVE-2026-88043
7.2HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browsers of users viewing affected pages. They only need network access to submit a payload via the vulnerable parameter.
Root cause
The plugin fails to sanitize and escape input supplied to the 'data_type' parameter before storing and rendering it.
Affected systems
Mang Board WP plugin for WordPress versions up to, and including, 2.4.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade Mang Board WP to a version newer than 2.4.0. If patching immediately is not possible, deactivate and uninstall the plugin until the update can be applied.
$ wp plugin update mangboardAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.