# CVE-2026-109998: Mang Board WordPress plugin stored XSS via content parameter

Source: https://junglewise.ai/threats/cve-2026-109998-the-mang-board-plugin-for-wordpress-is-vulnerable-to-stored  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109998 · Severity: high · CVSS 7.2 · Published 2026-10-16

The Mang Board plugin for WordPress, used to add discussion boards to websites, contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts. When visitors access pages containing the injected scripts, the malicious code executes in their browsers, potentially stealing session tokens, credentials, or redirecting users to phishing sites. The vulnerability is easily exploitable because the vulnerable endpoint is publicly accessible without authentication requirements.

Vendors: [Mang Board](https://junglewise.ai/threats/vendors/mang-board).

## Quick answers

**Is CVE-2026-109998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109998 being exploited in the wild.

**How severe is CVE-2026-109998?** High severity, with a CVSS score of 7.2, published 16 October 2026.

**Which products and versions are affected?** Mang Board up to and including 2.4.3.

**Is there a fix for CVE-2026-109998?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109998 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109998?** Check whether you run Mang Board at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wp_ajax_nopriv_mb_template endpoint in Mang Board fails to sanitize the 'content' parameter in the content_reply mode, and does not verify nonces before processing requests. The vulnerable code stores attacker-controlled data in the database, which is later output with insufficient escaping. Since admin-ajax.php returns Content-Type: text/html, browsers interpret and execute any embedded HTML/JavaScript tags in the JSON response body, enabling stored XSS attacks accessible to all site visitors.

## Affected products

- Mang Board Mang Board up to and including 2.4.3

## Timeline

- 2026-10-16: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php](https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php)
- [https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php](https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php)

## Related threats

- [Mang Board for WordPress stored cross-site scripting](https://junglewise.ai/threats/cve-2026-110071-the-mang-board-plugin-for-wordpress-is-vulnerable-to-stored)