Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
CVE

CVE-2026-3326

8.6
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Attack Vector
Network
Privileges Req.
None
User Interaction
None
xstore
Updated Nov 10, 2026View on NVD →
S4E scanner

XStore Theme < 9.7.3 - SQL Injection

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection References: https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/ https://nvd.nist.gov/vuln/detail/CVE-2026-3326 Remediation: Update XStore theme to version 9.7.3 or later.

10 assets checked · domain, subdomain, ipv4

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →