EUVD-2026-57979
GHSA-v3mp-84pw-5pr9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS requires no attacker privileges (PR:N) but mandates victim link interaction (UI:R); scope change (S:C) reflects browser-context execution outside the WordPress application boundary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
AnalysisAI
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress installation has the Agrion theme (by bracketweb) active and running at version 1.0.0 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) captures a reflected XSS with no authentication requirement and low attack complexity, offset by mandatory victim interaction (UI:R) which reduces mass-automated exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/agrion/vulnerability/wordpress-agrion-theme-1-0-0-reflected-cross-site-scripting-xss-vulnerability for the most current patch status; an exact fixed version is not confirmed in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all WordPress installations to identify deployments of Agrion theme version 1.0.0 or below and assess their internet exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today