CVE-2026-28113 is a reflected cross-site scripting vulnerability affecting azzaroco Ultimate Learning Pro through version 3.9.1. The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute when a user interacts with crafted content. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side impacts. The CVSS score of 7.1 indicates a high severity with potential impacts on confidentiality, integrity, and availability, but no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input or links related to Ultimate Learning Pro. Monitor vendor channels for updates and apply patches promptly once released.