PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105065 8theme.com CVE debrief

The XStore theme for WordPress has a Cross Site Scripting (XSS) vulnerability in versions before 9.7.9. This issue allows for Reflected XSS attacks. Defenders should assess exposure and prioritize upgrading to version 9.7.9 or later. The CVE record was published on 2026-10-15T17:00:15.222Z and has not been modified since then. The vulnerability affects WordPress installations using the XStore theme, requiring verification of theme versions and potential upgrades. The issue involves improper neutralization of input during web page generation, allowing Reflected XSS attacks.

Vendor
8theme.com
Product
XStore
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

Defenders responsible for WordPress installations using the XStore theme should assess exposure and prioritize upgrading to version 9.7.9 or later.

Why it matters

Defenders should care about CVE-2026-105065 because it involves a Cross Site Scripting (XSS) vulnerability in the XStore theme for WordPress, allowing for Reflected XSS attacks. This requires verification of XStore theme versions and potential upgrades to 9.7.9 or later.

  • Potential for Reflected XSS attacks
  • Need for version verification and upgrades
  • Possible impact on WordPress installations using XStore theme

Technical summary

The XStore theme for WordPress has a Cross Site Scripting (XSS) vulnerability in versions before 9.7.9. This issue allows for Reflected XSS attacks. The vulnerability involves improper neutralization of input during web page generation. Defenders should prioritize verifying XStore theme versions and upgrading to 9.7.9 or later if vulnerable. The issue affects WordPress installations using the XStore theme.

Defensive priority

Defenders should prioritize verifying XStore theme versions and upgrading to 9.7.9 or later if vulnerable.

Recommended defensive actions

  • Verify XStore theme version and upgrade to 9.7.9 or later if vulnerable
  • Review and update affected systems
  • Monitor for potential XSS attacks

Evidence notes

The CVE record and source item provide details on the Cross Site Scripting (XSS) vulnerability in XStore theme versions before 9.7.9. The vulnerability allows for Reflected XSS attacks and affects WordPress installations using the XStore theme. Defenders should verify XStore theme versions and upgrade to 9.7.9 or later if vulnerable. The source-provided CVE metadata and official CVE Program record offer additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105065 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105065

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105065 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105065

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.