PT-2026-27847 · Softwebmedia · Gyan Elements

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-23979

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Softwebmedia Gyan Elements versions n/a through 2.2.1

Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, potentially leading to reflected cross-site scripting (XSS). This allows an attacker to inject malicious scripts into a website, which can then be executed by unsuspecting users who visit the affected page. The injected scripts can steal sensitive information, redirect users to malicious websites, or modify the content of the web page.

Recommendations Update Gyan Elements to a version later than 2.2.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23979

Affected Products

Gyan Elements

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-23979 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/gyan-elements/vulnerability/wordpress-gyan-elements-plugin-2-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2038618106839421405 · Twitter Post