Cross-site Scripting Vulnerability in ThemeGrill eStore Web Application
CVE-2026-108485

7.1HIGH

Key Information:

Vendor

WordPress
Status
Estore
Vendor
CVE Published:
18 October 2026

What is CVE-2026-108485?

The ThemeGrill eStore web application is exposed to a Cross-site Scripting (XSS) vulnerability, allowing attackers to inject malicious scripts into web pages seen by other users. This flaw can lead to various attacks including session hijacking and the theft of sensitive information. Users of eStore versions from n/a through 1.6.13 are advised to implement measures to mitigate this risk and update their instances promptly.

Affected Version(s)

eStore 0 <= 1.6.13

References

https://patchstack.com/database/wordpress/theme/estore/vu...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku | Patchstack Bug Bounty Program
.