What is the CVSS score of CVE-2026-28073?

CVE-2026-28073 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wp Emember are affected by CVE-2026-28073?

A reflected XSS vulnerability in the WP eMember WordPress plugin (versions ≤10.2.2) allows attackers to execute malicious code in authenticated users' browsers through crafted URLs.

How to fix or mitigate CVE-2026-28073?

Within 24 hours: Inventory all WordPress instances running WP eMember and document current versions; notify security and WordPress administrator teams. Within 7 days: Disable the WP eMember plugin if not mission-critical, or restrict access to authenticated users only via WAF/network controls; monitor for suspicious activity. Within 30 days: Evaluate alternative membership plugins with active security maintenance; apply vendor patch immediately upon release or migrate to patched version.

Wp Emember CVE-2026-28073

EUVD-2026-13051 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 Patchstack

XSS Wp Emember

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 05:30 euvd

EUVD-2026-13051

Analysis Generated

Mar 19, 2026 - 05:30 vuln.today

CVE Published

Mar 19, 2026 - 05:18 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS.This issue affects WP eMember: from n/a through v10.2.2.

AnalysisAI

A reflected cross-site scripting (XSS) vulnerability exists in the WP eMember WordPress plugin by Tips and Tricks HQ, affecting all versions up to and including 10.2.2. An attacker can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript in the victim's browser context. This vulnerability has been publicly disclosed by Patchstack with no indication of active exploitation in the wild or KEV listing at this time.

Technical ContextAI

The vulnerability affects the WP eMember WordPress plugin (CPE: cpe:2.3:a:tips_and_tricks_hq:wp_emember:*:*:*:*:*:*:*:*), a membership management system for WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the plugin fails to properly sanitize user-supplied input before reflecting it in HTTP responses. This allows attackers to inject malicious JavaScript payloads into URL parameters or form fields that are then rendered without encoding in the victim's browser, enabling reflected XSS attacks. Unlike stored XSS, reflected XSS requires the victim to interact with a specially crafted link, making social engineering a necessary component of exploitation.

RemediationAI

Site administrators should immediately upgrade WP eMember to version 10.2.3 or later if available, checking the official WordPress plugin repository or the Tips and Tricks HQ vendor site for the patched version. Until patching is completed, implement defense-in-depth measures including deploying a Web Application Firewall (WAF) with XSS detection rules, enabling Content Security Policy (CSP) headers to restrict inline script execution, and educating users not to click on suspicious links related to membership management pages. Review the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-emember/vulnerability/wordpress-wp-emember-theme-v10-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for specific indicators of compromise and attack patterns. If the plugin is not actively used, consider disabling or removing it entirely until a patch is verified and applied.