CVE-2026-110071

Name of the Vulnerable Software and Affected Versions Mang Board versions prior to 2.4.6

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By manipulating the align parameter, an attacker can inject arbitrary web scripts into pages. These scripts execute when a user, including administrators previewing pending posts, accesses the affected page. The issue persists because the wp kses post function fails to remove the malicious attribute when the payload lacks angle brackets.

Recommendations Update Mang Board to version 2.4.6 or later. Restrict the use of the align parameter for users with contributor-level access until the update is applied.