Kitae Park vulnerabilities
12 vulnerabilities
Known vulnerabilities in Kitae Park products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Mang Board8 vulnerabilities
- Mang Board WP4 vulnerabilities
HighCVE-2026-109998kitae-park · mang boardMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAXThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.EPSS0.27%MediumCVE-2026-109512kitae-park · mang boardMang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' ParameterThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.EPSS0.22%CriticalCVE-2026-109219kitae-park · mang boardMang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' ParameterThe Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.EPSS0.69%HighCVE-2026-88043kitae-park · mang boardMang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' ParameterThe Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.24%HighCVE-2026-107751kitae-park · mang board +1 moreMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' ParameterThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.EPSS0.32%HighCVE-2026-104909kitae-park · mang board +1 moreMang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' ParameterThe Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.EPSS1.01%MediumCVE-2026-104761kitae-park · mang board +1 moreMang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' ParameterThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.31%MediumCVE-2025-12193kitae-park · mang board wp +1 moreMang Board WP <= 2.3.1 - Reflected Cross-Site ScriptingThe Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.EPSS0.22%MediumCVE-2025-3435kitae-park · mang board wp +1 moreMangBoard WP <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And FooterThe Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.EPSS0.23%MediumCVE-2026-13334kitae-park · mang board wp +1 moreMang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' ParameterThe Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.EPSS0.38%HighCVE-2026-75977kitae-park · mang board wp +1 moreMang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication CookieThe Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw_get_hash_key() function that uses the current user's identity instead of the cookie username parameter when a WordPress user is logged in, combined with insufficient validation in mbw_validate_auth_cookie(). This makes it possible for authenticated attackers, with subscriber-level access and above, to forge administrator authentication cookies and change administrator passwords to achieve complete site takeover.EPSS0.86%HighCVE-2026-96871kitae-park · mang board +1 moreMang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' ParameterThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards.EPSS0.24%