Ghostwire

CVE-2026-3326: The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL...

HIGH CVSS 7.5

Published: June 10, 2026 | Last Modified: June 10, 2026

Description

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Ghostwire Analysis — What This Means Practically

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
13 articles from independent security sources have covered this vulnerability, indicating significant industry attention.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (13 articles)

References

www.tenable.com/cve/CVE-2026-3326
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-3326