Vulnerabilities / Mang Board / WPSEC-2026-2627
Mang Board <= 2.4.7 - Reflected Cross-Site Scripting via Uploaded File Extension
Medium 6.1
CWE-79Fixed in 2.4.8
- ID
- WPSEC-2026-2627
- Plugin
- Mang Board (mangboard)
- Affected
- all versions before 2.4.8
- Remediation
- Update to 2.4.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Mang Board on WPSec AttackSurface
- Fix released
- Published
Description
The Mang Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the file name extension sent to the mb_uploader AJAX action in all versions up to, and including, 2.4.7, due to upload error messages containing the unsanitized extension being echoed without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser if they can trick the user into submitting a crafted upload request.
References
- https://wpsec.com/vuln/WPSEC-2026-2627/
- https://plugins.svn.wordpress.org/mangboard/tags/2.4.8/
- https://wordpress.org/plugins/mangboard/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS