CVE-2026-13334 Overview
CVE-2026-13334 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Mang Board WP plugin for WordPress. The flaw exists in all versions up to and including 2.3.4. The plugin fails to sanitize input and escape output for the stag parameter, allowing unauthenticated attackers to inject arbitrary JavaScript into rendered pages. Successful exploitation requires a victim to click a crafted link. Once triggered, the injected script executes in the victim's browser session under the origin of the vulnerable WordPress site. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, or administrative action hijacking if a logged-in administrator is targeted.
Affected Products
- Mang Board WP plugin for WordPress — all versions ≤ 2.3.4
- Vulnerable files include includes/class.store.php, includes/functions/func.board.php, and skins/bbs_basic/_header.php
- WordPress sites with the plugin active and publicly accessible
Discovery Timeline
- 2026-07-09 - CVE-2026-13334 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-13334
Vulnerability Analysis
The vulnerability stems from the Mang Board WP plugin reflecting the stag HTTP request parameter into rendered HTML without applying sanitization or output escaping. When a user visits a URL containing a malicious stag value, the plugin embeds the attacker-controlled string directly into the page body. The browser interprets the payload as executable script rather than data.
Because the attack executes in the context of the vulnerable WordPress origin, injected scripts can read cookies not marked HttpOnly, perform authenticated requests against the site's REST API, and manipulate the DOM. The scope change indicated by the CVSS vector reflects that the impact crosses the security boundary of the trusted WordPress origin. No authentication is required from the attacker, but user interaction — typically clicking a crafted link — is necessary to trigger the payload.
Root Cause
The root cause is missing input sanitization and missing output escaping on the stag query parameter across multiple plugin files. Affected sinks are visible in the Trac references, including class.store.php line 110, class.store.php line 122, func.board.php line 297, and _header.php line 26. The plugin should have applied sanitize_text_field() on input and esc_attr() or esc_html() on output, per WordPress secure coding standards.
Attack Vector
An attacker crafts a URL to a target site running the vulnerable plugin, embedding a JavaScript payload in the stag parameter. The attacker delivers the link through phishing email, social media, a compromised site, or a malicious advertisement. When a victim clicks the link, the plugin reflects the payload into the response, and the browser executes it. If the victim is an authenticated WordPress administrator, the attacker can pivot to account takeover by adding a new administrative user or exfiltrating nonces to perform privileged actions. See the Wordfence Vulnerability Report for additional detail.
Detection Methods for CVE-2026-13334
Indicators of Compromise
- Web server access logs containing requests with stag= parameters holding HTML tags, <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after visiting a URL with a stag parameter
- Unexpected creation of WordPress administrator accounts or modifications to plugin/theme files following link clicks
- Referrer chains showing WordPress admin users arriving at plugin pages from external phishing origins
Detection Strategies
- Deploy web application firewall rules that flag reflected XSS patterns in the stag query string on paths served by the Mang Board WP plugin
- Enable WordPress audit logging to correlate administrator activity with anomalous parameter values in HTTP requests
- Perform static code review of installed plugins to identify unescaped $_GET and $_REQUEST usages
Monitoring Recommendations
- Alert on HTTP requests to WordPress endpoints containing script tags or event handler attributes in URL parameters
- Monitor for new WordPress user accounts with the administrator role created outside change windows
- Track outbound HTTP requests from browser processes to newly registered domains following link clicks by privileged users
How to Mitigate CVE-2026-13334
Immediate Actions Required
- Update the Mang Board WP plugin to a version newer than 2.3.4 once released, per the plugin changeset
- Deploy WAF rules blocking requests where the stag parameter contains HTML or JavaScript syntax
- Instruct WordPress administrators to avoid clicking untrusted links to the site and to log out when not actively administering
- Audit recent administrator account changes, plugin installations, and theme file modifications for signs of exploitation
Patch Information
A patched release is tracked in the WordPress plugin repository changeset referenced above. Site operators should upgrade to the fixed version and verify that the stag parameter is sanitized on input and escaped on output in includes/class.store.php, includes/functions/func.board.php, and skins/bbs_basic/_header.php. Confirm the plugin version through the WordPress admin plugin list after upgrade.
Workarounds
- Deactivate and remove the Mang Board WP plugin until a fixed version is applied
- Add a Content Security Policy header restricting script-src to trusted origins with no unsafe-inline directive
- Configure the web server or WAF to reject requests where the stag parameter contains <, >, or %3C, %3E
- Restrict access to WordPress admin (/wp-admin) by IP allowlist to reduce the value of a hijacked session
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
