CVE Catalog
CVE-2026-28003
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.18%
8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist versions up to 2.9.1. An attacker can inject malicious script without authentication.
Risk Assessment
Risk of session hijacking, admin account takeover, or malware distribution on the site.
Recommendation
Update the Maspik – Spam blacklist plugin to the latest version that includes the security fix.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.