CVE-2026-105065
HighCVSS 7.1Summary
The XStore plugin for WordPress contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions prior to 9.7.9.
Risk Assessment
An attacker can trick a user into clicking a crafted link, allowing execution of malicious script in the victim's browser and theft of session data or actions performed on their behalf.
Recommendation
Update the XStore plugin to version 9.7.9 or later.
Other vulnerabilities in XStore
See all- CVE-2025-64192Medium
The XStore theme by 8theme is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions before 9.6.
- CVE-2025-60100Medium
XSS vulnerability in the XStore theme for WordPress allows injection of HTML/JavaScript code into a web page. Affects versions up to and including 9.6.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS