sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total10
Critical1
High6
Medium3
Reset
Showing 1-10 of 10 records
Threat Entry Updated 2026-10-23

Mangboard - Security Vulnerability (CVE-2026-109219)

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on…

PLUGIN Mangboard

CVE-2026-109219

CRITICAL CVSS 9.8 2026-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Mangboard - Security Vulnerability (CVE-2026-96871)

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards.

PLUGIN Mangboard

CVE-2026-96871

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Mangboard - Broken Access Control (CVE-2026-75977)

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw_get_hash_key() function that uses the current user's identity instead of the cookie username parameter when a WordPress user is logged in, combined with insufficient validation in mbw_validate_auth_cookie(). This makes it possible for authenticated attackers, with subscriber-level access and above, to forge administrator authentication cookies and change administrator passwords to achieve complete site takeover.

PLUGIN Mangboard

CVE-2026-75977

HIGH CVSS 8.8 2026-08-26
Open Full Technical Breakdown
Threat Entry Updated 2026-07-09

Mangboard - Cross-Site Scripting (XSS) (CVE-2026-13334)

The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Mangboard

CVE-2026-13334

MEDIUM CVSS 6.1 2026-07-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Mangboard - Cross-Site Scripting (XSS) (CVE-2025-3435)

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

PLUGIN Mangboard

CVE-2025-3435

MEDIUM CVSS 4.4 2025-04-24
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.