ThemeGrill eStore EUVD-2026-103422

Exploitation requires an attacker to lure a victim into loading a crafted URL against a site running the ThemeGrill eStore theme (versions up to 1.6.13), because the flaw is reflected XSS - the malicious input must be echoed back in a single response rather than stored. The CVSS vector shows PR:N (no attacker authentication needed) but UI:R, meaning the primary limiting factor is mandatory victim interaction: the target must click or open the attacker's link, and the stolen context is only as privileged as that victim's session. There is no self-propagation and no persistence; impact is bounded to users who follow the malicious link while the vulnerable theme version is active.

This is a reflected cross-site scripting (CWE-79) flaw in the ThemeGrill eStore WordPress theme (versions up to and including 1.6.13), reported by Patchstack. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates a network-reachable, low-complexity issue requiring no attacker privileges but DOES require victim user interaction (UI:R) - consistent with reflected XSS, where a victim must click or load an attacker-crafted link. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation: this is no public exploit identified at time of analysis. The 7.1 'High' rating is driven largely by the Scope-change (S:C) and triple low impacts that Patchstack applies by convention to XSS; in practice reflected XSS is meaningfully gated by the user-interaction requirement and does not self-propagate, making real-world risk lower than the raw score suggests. Note a conflict to verify: the vector asserts A:L (availability impact), which is unusual for a reflected XSS that merely executes script in a victim's browser - treat the availability impact as questionable. Overall this is a legitimate but not emergency-priority web vulnerability; patch in normal cycles unless the theme is internet-facing on a high-value WordPress site.

An attacker crafts a URL for the eStore theme containing a malicious script payload in a reflected parameter and delivers it to a logged-in site user or administrator via phishing, a comment, or a social post. When the victim opens the link, the unsanitized input is reflected into the generated page and the script executes in their browser session, allowing cookie/session theft or actions in the victim's context. No public POC was provided, and successful exploitation depends on the victim clicking the attacker-supplied link (UI:R).