Reflected cross-site scripting in WordPress XStore theme
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
A reflected cross-site scripting flaw (CWE-79) in the XStore theme from 8theme.com before 9.7.9 lets an attacker inject script into pages generated by the theme. An attacker needs to get a victim to open a crafted link, which requires user interaction and no privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| 8theme.com | XStore | before 9.7.9 | 9.7.9 | Patch available | CNA |
- XStore Vendor8theme.com Affected before 9.7.9 Fixed in 9.7.9 Patch available CNA
Remediation
Update XStore to version 9.7.9, which fixes the flaw. The sources list no advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA XStore (8theme.com) Fixed in 9.7.9
Timeline
- 2026-10-16 Threatist record created from CVE-2026-105065
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: MEDIUM → LOW
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences