XStore Theme CVE-2026-105065

Exploitation requires a victim to click or load an attacker-crafted URL (UI:R) containing a payload that the XStore theme reflects without proper neutralization into the generated web page; the attacker needs no authentication (PR:N) but cannot act without victim interaction. The specific vulnerable parameter, page, or theme feature is not named in the description and should be obtained from the Patchstack advisory. Limiting factors: the reflected (non-persistent) nature means each victim must be individually lured, no payload persists on the server, impact is confined to the victim's browser session within the site origin, and all affected installations are those running XStore before version 9.7.9.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity, unauthenticated reflected XSS that requires user interaction, with a scope change into the victim's browser context. The signals are mixed on priority: the vulnerability is remotely reachable with no authentication (PR:N), which raises reach, but the mandatory user-interaction requirement (UI:R) and the reflected (non-persistent) nature substantially limit real-world impact compared to stored XSS. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this currently reads as a medium-priority web vulnerability rather than an urgent threat. One notable inconsistency: the supplied vector claims Availability impact (A:L), which is atypical for a reflected XSS that neutralizes output during page generation; XSS normally yields confidentiality/integrity impact in the browser but not availability - verify this metric with the vendor/Patchstack, as it may inflate the base score.

An unauthenticated attacker crafts a malicious URL targeting a vulnerable XStore parameter that reflects unsanitized input into the generated page, then lures a logged-in site visitor or administrator into clicking it (e.g., via phishing or a malicious link). When the victim's browser renders the response, attacker-controlled JavaScript executes in the site's origin, enabling session/cookie theft or actions on behalf of the victim. No public exploit code is identified at time of analysis.