CVE-2026-24943

High

Published: 20 February 2026

Published

20 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0004 14.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24943 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-24943 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, enabling reflected cross-site scripting (XSS) in the Grand Conference WordPress theme developed by ThemeGoods. This issue affects Grand Conference theme versions from an unspecified initial release through 5.3.4. The vulnerability was published on 2026-02-20 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its potential for exploitation over the network with low complexity.

Attackers can exploit this reflected XSS vulnerability remotely without privileges by crafting malicious inputs, such as URLs, that trick users into interacting via a browser, such as clicking a link. Successful exploitation allows arbitrary JavaScript execution in the context of the victim's browser session on the affected site, potentially leading to low-level impacts on confidentiality (e.g., session token theft), integrity (e.g., data manipulation), and availability, with the changed scope (S:C) enabling cross-origin effects.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/grandconference/vulnerability/wordpress-grand-conference-plugin-5-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the reflected XSS vulnerability specific to Grand Conference theme version 5.3.4 and provides guidance on mitigation, including recommendations for updating to a patched version where available.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-7480

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Reflected XSS enables arbitrary JS execution in victim browser when user clicks crafted malicious URL/link (T1204.001); directly facilitates JS code execution via T1059.007.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1