## Summary
CVE-2026-28003 is an unauthenticated Cross-Site Scripting (XSS) issue in the WordPress plugin Maspik – Spam blacklist affecting versions <= 2.9.1. Attackers can inject malicious scripts that execute in victims’ browsers.
## Technical Details
- Type: Unauthenticated XSS (CWE-79) in Maspik – Spam blacklist.
- Preconditions/interaction: exploitation can be initiated without authentication, but successful impact may require a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form.
- Result: injected payloads may perform browser-executed actions such as redirects, advertisements, or other HTML/JS payloads.
- CVSS (provided): 7.1 with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.
## Affected
- WordPress plugin: Maspik – Spam blacklist
- Affected versions: <= 2.9.1
- Fixed/resolved: update to 2.9.2 or later.
## Impact
- Malicious script injection leading to client-side execution when guests visit affected pages.
- Potential for session/interaction manipulation consistent with XSS outcomes (e.g., redirects and advertisement injection), with low-to-moderate confidentiality/integrity/availability impact as reflected in the provided CVSS.
- Patchstack notes the vulnerability is expected to become exploited and may be used in mass-exploit campaigns.
## Mitigation
1. Update the plugin immediately: upgrade Maspik – Spam blacklist to 2.9.2 or later.
2. If you cannot update right away, use compensating controls such as Patchstack’s mitigation rule to block attacks until patched.
3. Enable auto-updates for vulnerable plugins where supported (Patchstack users can enable auto-update for vulnerable plugins only).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CWE-79