CVE-2026-108485: WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress eStore themeto a version that resolves this vulnerability.Fixed in 1.6.14
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker can attempt exploitation remotely without prior authentication, but successful exploitation requires a user to interact with a crafted request or page.
What is the potential impact if exploitation succeeds?
Successful reflected XSS can expose or alter information in the affected site context and can affect availability. The CVSS vector indicates impacts to confidentiality, integrity, and availability are each rated low, with scope changed.
Which eStore versions are affected?
eStore versions through 1.6.13 are affected. The available data does not identify a fixed version.