What is the CVSS score of EUVD-2026-15600?

EUVD-2026-15600 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Visionary Core are affected by EUVD-2026-15600?

CVE-2026-24980 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate EUVD-2026-15600?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Visionary Core EUVD-2026-15600

| CVE-2026-24980 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-497h-26fm-j4hr

XSS Visionary Core

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15600

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme Visionary Core WordPress plugin through version 1.4.9, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. This vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), affects all installations of the plugin up to and including version 1.4.9. An attacker can craft a malicious link to steal session cookies, perform unauthorized actions on behalf of logged-in users, or redirect users to phishing sites, with the attack vector being network-based and requiring no authentication.

Technical ContextAI

The vulnerability resides in the NooTheme Visionary Core plugin (identified via CPE cpe:2.3:a:nootheme:visionary_core:*:*:*:*:*:*:*:*), a WordPress plugin that likely handles user input through HTTP request parameters for dynamic page generation. The root cause is classified under CWE-79, which describes failures to properly sanitize and validate user-supplied input before it is output into HTML/JavaScript contexts. In typical WordPress plugin architecture, this occurs when query parameters, form fields, or other user-controlled data are echoed directly into page output without HTML entity encoding, JavaScript escaping, or context-appropriate sanitization, allowing an attacker's injected script tags or event handlers to execute in the victim's browser within the context of the vulnerable website's origin.

RemediationAI

Immediately upgrade NooTheme Visionary Core to a version newer than 1.4.9; check the vendor's official repository or plugin page for the latest patched release and deployment instructions. Until patching is feasible, implement Web Application Firewall (WAF) rules to block common XSS payloads, enforce Content Security Policy (CSP) headers to restrict inline script execution, and educate users not to click untrusted links pointing to your domain. If the plugin cannot be upgraded promptly, consider disabling it temporarily and using an alternative if available. Additionally, monitor plugin usage and user sessions for signs of compromise (unauthorized actions, session hijacking) and ensure all WordPress core and plugin updates are current to minimize overall attack surface.