Live › vulnerability › CVE-2026-108485
Go to dashboardThemeGrill eStore, a WordPress theme, does not neutralize input in some pages, so a crafted link can inject script. An attacker who gets a user to open that link can run script in the victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ThemeGrill eStore theme at version 1.6.13 or earlier are exposed. The flaw is in the theme's page output, so any site with the theme active is in scope. Sites that do not use eStore can skip it.
No product ranges from the sources yet.
1.6.13 as affected.1.6.13 from ThemeGrill or the WordPress theme directory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-108485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.