What is the CVSS score of CVE-2026-24975?

CVE-2026-24975 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Organici Library are affected by CVE-2026-24975?

CVE-2026-24975 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-24975?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Organici Library CVE-2026-24975

EUVD-2026-15590 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-68v7-x8g4-p4cp

XSS Organici Library

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15590

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme's Organici Library plugin for WordPress, affecting versions up to and including 2.1.2. The vulnerability allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users through crafted URLs or form inputs, potentially stealing session cookies, credentials, or performing actions on behalf of victims. While no CVSS score or EPSS data is publicly available, the reflected XSS classification (CWE-79) combined with the lack of apparent access restrictions suggests moderate to high real-world risk, particularly in WordPress environments where plugin vulnerabilities are frequently exploited.

Technical ContextAI

The Organici Library (cpe:2.3:a:nootheme:organici_library) is a WordPress plugin developed by NooTheme that provides design and layout components. The vulnerability stems from improper input validation and output encoding during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, the plugin fails to properly sanitize and escape user-controlled input before rendering it in HTML context, allowing attackers to break out of intended data contexts and inject arbitrary JavaScript code. This is a classic reflected XSS flaw where malicious payloads are passed through HTTP request parameters and immediately reflected in the response without adequate neutralization.

RemediationAI

Update the Organici Library plugin to a patched version beyond 2.1.2 immediately through the WordPress plugin management interface or directly from the WordPress Plugin Repository. The primary remediation is to upgrade to the latest available version released by NooTheme after this vulnerability was disclosed. Until patching is possible, implement input validation and output encoding controls at the WordPress level by installing a Web Application Firewall (WAF) plugin such as Wordfence or Sucuri that can detect and block reflected XSS payloads. Additionally, enforce Content Security Policy (CSP) headers via a WordPress security plugin to mitigate the impact of injected scripts, and restrict administrative and sensitive functionality access to trusted IP ranges. Monitor the official Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/noo-organici-library) for patch availability and version release announcements.