PT-2026-23382 · Lambertgroup · Lambertgroup - Allinone - Banner With Thumbnails

João Pedro S Alcântara + 1 · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-28108

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LambertGroup LambertGroup - AllInOne - Banner with Thumbnails versions through 3.8

Description The software contains a Reflected Cross-site Scripting issue due to Improper Neutralization of Input During Web Page Generation. The issue affects the processing of web page generation, potentially allowing attackers to inject malicious scripts. The vulnerable component is LambertGroup - AllInOne - Banner with Thumbnails.

Recommendations Versions prior to and including 3.8 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28108

Affected Products

Lambertgroup - Allinone - Banner With Thumbnails

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-28108 · Security Note
• https://twitter.com/infoflowcloud/status/2029455876562583618 · Twitter Post
• https://twitter.com/CVEnew/status/2029454853609799837 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/all-in-one-thumbnailsBanner/vulnerability/wordpress-lambertgroup-allinone-banner-with-thumbnails-plugin-3-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note