CVE-2026-3326 — XStore < 9.7.3 - Unauthenticated SQLi

CVE-2026-3326

XStore < 9.7.3 - Unauthenticated SQLi PUBLISHED

Description (CNA)

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected (CNA)

Vendor / product	Versions
Unknown / Xstore	affected 0 before 9.7.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.