CVE-2026-108485
7.1HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary script in a victim's browser session if they trick a user into clicking a crafted link. This can lead to session hijacking or unauthorized actions within WordPress.
Root cause
The theme fails to neutralize user-supplied input before rendering it in web pages, resulting in reflected cross-site scripting.
Affected systems
ThemeGrill eStore through 1.6.13
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade eStore to a version newer than 1.6.13 once available. If an update is not yet available, switch to an alternative theme or block suspicious query parameters at your WAF.
$ wp theme update estoreAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.