XStore Theme < 9.7.3 - SQL Injection

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection id: CVE-2026-3326 info: name: XStore Theme 9.7.3 - SQL Injection author: VixianSchool...

CVE-2026-3326

creationtimestamp| type| source ---|---|--- 2026-06-10 10:51:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwk66y52s2r 2026-06-10 12:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnwnylckjr2p...