CVE Catalog
CVE-2026-28158
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.18%
8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.
Risk Assessment
Risk of session hijacking, admin account takeover, or malware distribution on the site.
Recommendation
Update the Do Lasso plugin to the latest version that includes the security fix.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.