CVE-2026-105065
7.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session to steal cookies or manipulate the page. Exploitation requires tricking an authenticated user into clicking a crafted malicious link.
Root cause
The theme fails to sanitize and neutralize user-supplied input before reflecting it into web pages, causing reflected cross-site scripting.
Affected systems
8theme.com XStore theme versions prior to 9.7.9
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade the XStore theme to version 9.7.9 or later. If patching immediately is not possible, block or filter malicious query parameters using a web application firewall rule.
$ wp theme update xstoreAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.