CVE Catalog
CVE-2026-3326
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk0.06%
20th percentile - higher than 20% of all known CVEs
Summary
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to data exposure or system compromise.
Recommendation
It is recommended to update the Xstore theme to version 9.7.3 or later to mitigate this vulnerability.
Original NVD description (English source)
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection