Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.
AnalysisAI
SQL injection in 8theme XStore WordPress theme versions up to and including 9.3.5 allows remote unauthenticated attackers to manipulate backend database queries by injecting crafted SQL syntax through user-controllable input. The flaw carries a CVSS 9.3 rating with scope change, and publicly available exploit code exists, while EPSS places exploitation probability at 5.82% (91st percentile), indicating elevated but not yet confirmed widespread abuse. No CISA KEV listing has been recorded for this issue at time of analysis.
Technical ContextAI
XStore is a widely deployed commercial WooCommerce/WordPress theme by 8theme used to power online retail storefronts. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into SQL statements without proper parameterization or escaping via WordPress's $wpdb prepared statement APIs. Because the CVSS scope is Changed (S:C), the injected query likely crosses a trust boundary - for example, executing under the WordPress database user with access to authentication tables, customer PII, and order data beyond the vulnerable component's own context.
Affected ProductsAI
8theme XStore WordPress/WooCommerce theme from an unspecified earliest version through 9.3.5 inclusive. The vulnerability was reported and coordinated by Patchstack (audit@patchstack.com), and site administrators should consult the corresponding Patchstack advisory and the official 8theme changelog at 8theme.com for the authoritative list of fixed builds.
RemediationAI
Upgrade the XStore theme to the first vendor-fixed release published after 9.3.5 via the 8theme customer portal or the WordPress theme updater - refer to the Patchstack advisory (patchstack.com) and 8theme's changelog for the exact patched version, as no specific fix version was provided in the available intelligence and no vendor-released patched version is independently confirmed here. If immediate patching is not possible, deploy a WordPress-aware WAF such as Patchstack, Wordfence, or Cloudflare with virtual patching rules for this CVE, restrict access to non-essential XStore AJAX and REST endpoints at the web server level, and enable database query logging to detect injection attempts; note that aggressive WAF rules can break legitimate WooCommerce checkout flows, so tune rules in monitor mode first. Rotate WordPress database credentials and audit wp_users plus customer/order tables for signs of prior data extraction.
Share
External POC / Exploit Code
Leaving vuln.today