What is the CVSS score of EUVD-2026-57979?

EUVD-2026-57979 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Agrion WordPress Theme are affected by EUVD-2026-57979?

The Agrion WordPress theme (versions 1.0.0 and below) contains a reflected cross-site scripting vulnerability that enables unauthenticated attackers to inject arbitrary JavaScript into user browsers…

How to fix or mitigate EUVD-2026-57979?

Within 24 hours, conduct a complete inventory of all WordPress installations to identify deployments of Agrion theme version 1.0.0 or below and assess their internet exposure. Within 7 days, deploy Web Application Firewall rules to block XSS payloads in URL parameters, implement Content Security Policy headers to restrict inline script execution, and consider temporarily disabling the Agrion theme in favor of a maintained alternative. Within 30 days, establish vendor monitoring for Agrion security patches and finalize a remediation plan such as permanent theme replacement or a scheduled update when the vendor releases a patched version.

Agrion WordPress Theme EUVD-2026-57979

| CVE-2026-65580 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-v3mp-84pw-5pr9

WordPress XSS Agrion Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered reflected XSS requires no attacker privileges (PR:N) but mandates victim link interaction (UI:R); scope change (S:C) reflects browser-context execution outside the WordPress application boundary.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:43 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

AnalysisAI

Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.

Technical ContextAI

Agrion is a WordPress theme developed by bracketweb (CPE: cpe:2.3:a:bracketweb:agrion:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of user-supplied input before it is reflected into the HTTP response. In the WordPress ecosystem, themes control page rendering and commonly process URL parameters for layout or search functionality; a failure to encode these parameters allows an attacker-controlled string to be interpreted as executable HTML or JavaScript by the victim's browser. The CVSS Scope Changed (S:C) metric reflects that successful exploitation extends impact beyond the WordPress application to the browser's document context, where attacker-controlled script inherits the victim's authenticated session.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/agrion/vulnerability/wordpress-agrion-theme-1-0-0-reflected-cross-site-scripting-xss-vulnerability for the most current patch status; an exact fixed version is not confirmed in the available intelligence. If a patched theme version has been released to the WordPress theme repository, administrators should update immediately via the WordPress dashboard. If no patched release is available, the recommended compensating control is to deactivate and replace the Agrion theme with an alternative - this eliminates the attack surface entirely with no side effects beyond visual/layout changes requiring redesign effort. A secondary compensating control is deploying a Web Application Firewall (WAF) with reflected XSS ruleset (e.g., Cloudflare, Sucuri, or ModSecurity with OWASP CRS), which can block common XSS payloads in URL parameters; however, WAF rules carry a risk of false positives on legitimate traffic and should be monitored after deployment. Output encoding at the theme level or a WordPress security plugin enforcing Content Security Policy headers (CSP) are additional hardening measures but require developer-level configuration.