CVE-2026-28073
Reflected XSS in WP eMember Plugin Allows Web Attacks
Publication date: 2026-03-19
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tips_and_tricks_hq | wp_emember | From 1.0.0 (inc) to 10.2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28073 is a medium priority Cross Site Scripting (XSS) vulnerability affecting the WordPress WP eMember Plugin versions up to and including v10.2.2.
This vulnerability allows attackers to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into websites, which execute when visitors access the compromised site.
Exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form, although the initial action can be initiated by an unauthenticated user.
It is classified under the OWASP Top 10 category A3: Injection and has a CVSS score of 7.1, indicating moderate severity.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to unauthorized redirects, display of unwanted advertisements, or other harmful HTML payloads.
Such attacks can compromise the integrity and trustworthiness of your website, potentially harming your users and damaging your reputation.
Because exploitation requires user interaction, attackers may trick privileged users into triggering the malicious payload, increasing the risk of successful attacks.
The vulnerability is likely to be targeted in mass-exploit campaigns affecting many websites regardless of their traffic or popularity.
No official patch is currently available, but mitigation rules exist to block attacks until a patch is released.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2026-28073 is a reflected Cross Site Scripting (XSS) vulnerability affecting the WordPress WP eMember Plugin up to version 10.2.2. Detection typically involves monitoring for suspicious HTTP requests that include malicious script payloads or unusual URL parameters that could trigger the reflected XSS.
While no specific detection commands are provided, common approaches include using web vulnerability scanners that can test for reflected XSS vulnerabilities by sending crafted requests and analyzing responses for script injection.
Additionally, inspecting web server logs for unusual query strings or payloads that contain script tags or JavaScript code can help identify attempts to exploit this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for CVE-2026-28073, immediate mitigation involves applying the mitigation rule provided by Patchstack to block attacks targeting this vulnerability.
Users are advised to update the WP eMember plugin as soon as an official patch is released.
In the meantime, seeking assistance from your hosting provider or web developer to implement protective measures such as web application firewalls (WAF) or custom filtering rules can help reduce the risk.