CVE-2026-28101
Reflected XSS in UberSlider MouseInteraction Plugin
Publication date: 2026-03-05
Last updated on: 2026-03-05
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lambertgroup | uberslider_mouseinteraction | to 2.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28101 is a medium severity Cross Site Scripting (XSS) vulnerability affecting the WordPress UberSlider MouseInteraction Plugin versions 2.3 and earlier.
This vulnerability allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the compromised site.
Exploitation requires user interaction, such as a privileged user clicking a malicious link, visiting a crafted page, or submitting a form.
The vulnerability falls under the OWASP Top 10 category A3: Injection and is specifically classified as Cross Site Scripting (XSS).
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts on your website, which can lead to unauthorized redirects, display of unwanted advertisements, or other harmful HTML payloads.
Such attacks can compromise the integrity and trustworthiness of your website, potentially harming your users and damaging your reputation.
Since exploitation requires user interaction, attackers may trick users or administrators into triggering the malicious payload.
Currently, no official patch is available, but mitigation rules exist to block attacks until a fix is released.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a reflected Cross Site Scripting (XSS) issue in the UberSlider MouseInteraction WordPress plugin versions 2.3 and earlier. Detection typically involves monitoring for suspicious script injections or unusual HTTP requests that include malicious payloads targeting the plugin.
Since no official patch is available and the vulnerability requires user interaction via crafted links or forms, detection can be performed by inspecting web server logs for unusual query parameters or payloads that include script tags or suspicious HTML.
Specific commands are not provided in the available resources, but common approaches include using web vulnerability scanners or manual inspection with tools like curl or wget to test for reflected script injection by sending crafted requests to the affected endpoints.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, immediate mitigation involves applying the Patchstack mitigation rule designed to block attacks targeting this issue.
Website owners should implement automated mitigation solutions provided by Patchstack to proactively protect their sites from exploitation.
Additionally, limiting user interactions with untrusted links, educating privileged users about the risk of clicking suspicious links or submitting forms, and monitoring for suspicious activity can help reduce the risk until an official fix is released.