What is the CVSS score of CVE-2026-23979?

CVE-2026-23979 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Gyan Elements are affected by CVE-2026-23979?

CVE-2026-23979 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-23979?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Gyan Elements CVE-2026-23979

EUVD-2026-15551 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-gr57-r782-r33x

XSS Gyan Elements

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15551

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softwebmedia Gyan Elements gyan-elements allows Reflected XSS.This issue affects Gyan Elements: from n/a through <= 2.2.1.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Softwebmedia Gyan Elements WordPress plugin through version 2.2.1, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. This vulnerability affects all versions up to and including 2.2.1, enabling attackers to steal session tokens, perform unauthorized actions, or harvest sensitive user data. While no CVSS score or EPSS data is currently published, the nature of reflected XSS combined with WordPress plugin distribution suggests moderate-to-high real-world exploitation potential, particularly if users remain on vulnerable versions.

Technical ContextAI

The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Gyan Elements plugin (CPE: cpe:2.3:a:softwebmedia:gyan_elements:*:*:*:*:*:*:*:*) fails to properly sanitize or validate input parameters before rendering them in HTTP responses, allowing an attacker to inject arbitrary JavaScript code into the page. This is a client-side vulnerability where the malicious payload reaches the victim's browser without server-side validation, making it a reflected XSS variant that does not persist in the database but rather travels via URL parameters or POST data.

RemediationAI

The primary remediation is to upgrade Gyan Elements to a patched version beyond 2.2.1; administrators should check the official Softwebmedia or WordPress.org plugin repository for available security updates and apply them immediately. Until patching is completed, administrators should restrict plugin functionality or disable the plugin entirely if not critical to operations. Additionally, implement Web Application Firewall (WAF) rules to detect and block reflected XSS patterns targeting the affected plugin's endpoints, enforce Content Security Policy (CSP) headers to restrict inline script execution, and educate end-users not to click on suspicious links containing unusual URL parameters. Monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/gyan-elements/) and official WordPress security sources for patch release announcements.