Is CVE-2026-122666 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122666 being exploited in the wild.

How severe is CVE-2026-122666?

High severity, with a CVSS score of 7.1, published 9 November 2026.

Which products and versions are affected?

Kitae-Park Mang Board WP through 2.4.7.

Is there a fix for CVE-2026-122666?

Yes: fixed in 2.4.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122666 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-122666?

Check whether you run Kitae-Park Mang Board WP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122666: Kitae Park Mang Board WP reflected XSS

CVE-2026-122666 · Severity: high · CVSS 7.1 · Published 2026-11-09

Mang Board WP is a WordPress plugin used to manage message boards and forums. A reflected cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that execute in a visitor's browser, potentially stealing credentials, hijacking accounts, or redirecting users to phishing pages. The vulnerability requires user interaction, such as clicking a malicious link.

Technologies: Kitae-Park Mang Board WP. Vendors: Kitae-Park.

Quick answers

Is CVE-2026-122666 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122666 being exploited in the wild.
How severe is CVE-2026-122666?: High severity, with a CVSS score of 7.1, published 9 November 2026.
Which products and versions are affected?: Kitae-Park Mang Board WP through 2.4.7.
Is there a fix for CVE-2026-122666?: Yes: fixed in 2.4.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122666 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-122666?: Check whether you run Kitae-Park Mang Board WP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.4.8

Technical details

The plugin fails to properly neutralize user-supplied input during web page generation, enabling reflected XSS attacks. An unauthenticated attacker can craft a malicious URL containing JavaScript code that executes in victims' browsers when clicked. User interaction is required for successful exploitation.

Affected products

Kitae Park Mang Board WP through 2.4.7

Timeline

2026-11-01: disclosed
2026-11-07: advisory
2026-11-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.