{"id":"CVE-2026-108485","kind":"vulnerability","aliases":["CVE-2026-108485"],"related":[],"title":"ThemeGrill eStore WordPress theme: reflected XSS through version 1.6.13","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.","summary":"ThemeGrill eStore, a WordPress theme, does not neutralize input in some pages, so a crafted link can inject script. An attacker who gets a user to open that link can run script in the victim's browser session.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["estore","package","themes","wordpress"],"not_affected_if":["theme-not-installed"],"how_to_check":"- Look at the installed eStore theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Treat any version up to and including `1.6.13` as affected.","fix":"- Update the eStore theme to a version later than `1.6.13` from ThemeGrill or the WordPress theme directory.\n- unknown for a patched version number; the sources do not name one.","status":"open","published_at":"2026-10-18T11:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:10+00:00","updated_at":"2026-10-25T03:36:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the eStore theme to a version later than `1.6.13` from ThemeGrill or the WordPress theme directory.\n- unknown for a patched version number; the sources do not name one.","reach":"internet","title":"ThemeGrill eStore WordPress theme: reflected XSS through version 1.6.13","impact":"medium","summary":"ThemeGrill eStore, a WordPress theme, does not neutralize input in some pages, so a crafted link can inject script. An attacker who gets a user to open that link can run script in the victim's browser session.","category":"package","nicknames":[],"who_cares":["wordpress","themes","estore"],"confidence":0.6,"needs_auth":"no","worst_case":"script runs in a visitor's browser, session tokens can be stolen","analyst_note":"Confirm the patched eStore version and the affected URL parameters from the NVD or ThemeGrill advisory.","how_to_check":"- Look at the installed eStore theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Treat any version up to and including `1.6.13` as affected.","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the ThemeGrill eStore theme at version 1.6.13 or earlier are exposed. The flaw is in the theme's page output, so any site with the theme active is in scope. Sites that do not use eStore can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000598,"input_tokens":3304,"output_tokens":535,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108485':12A,15A '-2026':11A,14A '1.6.13':9A,84C 'affect':79C 'allow':75C 'attack':40B 'browser':56B 'craft':34B 'cross':67C 'cross-sit':66C 'cve':10A,13A 'estor':2A,16B,21B,73C,74C,80C 'generat':65C 'get':42B 'improp':58C 'inject':37B 'input':28B,61C 'issu':78C 'link':35B,48B 'n/a':82C 'neutral':27B,59C 'open':46B 'packag':17B 'page':31B,64C 'reflect':5A,76C 'run':50B 'script':38B,51B,69C 'session':57B 'site':68C 'theme':4A,18B,24B 'themegril':1A,20B,72C 'user':44B 'version':8A 'victim':54B 'vulner':70C 'web':63C 'wordpress':3A,19B,23B 'xss':6A 'xss.this':77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ThemeGrill eStore theme at version 1.6.13 or earlier are exposed. The flaw is in the theme's page output, so any site with the theme active is in scope. Sites that do not use eStore can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108485","severity":null,"published_at":"2026-10-18T11:16:36+00:00","modified_at":"2026-10-19T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}