CVE-2026-105065

Deferred Deferred - Pending Action

XStore Reflected Cross-Site Scripting Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105065

EUVD

EUVD-2026-102201

Affected Vendors & Products

Vendor	Product	Version / Range
8theme.com	XStore	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-site Scripting (XSS) vulnerability in the 8theme.com XStore theme. It occurs when user input is not properly neutralized during web page generation, allowing malicious scripts to be executed in a victim's browser. The issue affects XStore versions before 9.7.9.

Detection Guidance

Detecting reflected XSS vulnerabilities typically involves manual testing or automated scanning tools. Check web application logs for suspicious input patterns like script tags or event handlers. Use tools like OWASP ZAP or Burp Suite to fuzz inputs and monitor responses for XSS payloads.

Impact Analysis

An attacker could trick users into clicking a malicious link, leading to execution of arbitrary scripts in their browser. This may result in theft of session cookies, account takeover, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability enables reflected cross-site scripting (XSS), which could allow attackers to inject malicious scripts into web pages viewed by users. Such attacks may lead to unauthorized data access, session hijacking, or defacement, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy) compliance by exposing sensitive user information.

Mitigation Strategies

Update XStore to version 9.7.9 or later to address the vulnerability. If immediate update is not possible, implement input validation and output encoding for user-supplied data. Disable or restrict user-generated content until patched.

Hi! I’m here to help you understand CVE-2026-105065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70