CVE-2026-28110 is a reflected cross-site scripting vulnerability in LambertGroup - AllInOne - Banner with Playlist (<= 3.8). The issue is caused by improper neutralization of input during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. The vulnerability has a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network exploitable with low complexity, no privileges, but requiring user interaction, and impacts confidentiality, integrity, and availability at a low level. No patch or vendor advisory information is provided, and no known exploits are reported.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity with partial impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules or input validation as temporary mitigations. Monitor vendor channels for updates and apply patches promptly once released.