CVE-2026-28158
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.
Risk Assessment
Risk of session hijacking, admin account takeover, or malware distribution on the site.
Recommendation
Update the Do Lasso plugin to the latest version that includes the security fix.
Other vulnerabilities in Do Lasso
See all- CVE-2026-28157High
Path Traversal vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows access to files outside the root directory.
- CVE-2026-28156High
SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.
- CVE-2026-28155Medium
Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Do Lasso up to version 358 allows an unauthenticated attacker to access objects without authorization.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS