CVE-2026-105065: WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress XStore themeto a version that resolves this vulnerability.Fixed in 9.7.9
Event History
Frequently Asked Questions
Which XStore installations are affected?
XStore versions before 9.7.9 are affected. The provided data does not identify a lower bound for affected versions.
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely with low attack complexity and no privileges, but it requires user interaction. The issue is a reflected XSS vulnerability, meaning attacker-controlled input must be rendered in a web page context.
Is the default configuration known to be affected?
The available data does not state whether the vulnerable behavior is enabled or reachable in a default XStore configuration.
What should be done if the site cannot be updated immediately?
The provided data identifies version 9.7.9 as the fixed version but does not provide validated temporary mitigations. Prioritize updating XStore to 9.7.9 or later when possible.