Reflected XSS Vulnerability in ThemeGrill eStore Plugin

The eStore plugin by ThemeGrill is vulnerable to a reflected cross-site scripting (XSS) flaw, identified as CVE-2026-108485. This vulnerability exists due to the improper neutralization of user-supplied input during the web page generation process. Attackers can leverage this flaw by tricking an authenticated or unauthenticated user into clicking a malicious link that includes a crafted script. When the application reflects this input back to the user's browser without adequate sanitization, the script executes within the victim's session context. This vulnerability affects all eStore versions from inception through 1.6.13 and may result in session hijacking, unauthorized actions performed on behalf of the user, or the redirection of visitors to malicious websites.

Impact

Successful exploitation of this reflected XSS vulnerability can lead to full compromise of a user's session within the WordPress environment. Depending on the privileges of the victim, an attacker could potentially modify site content, elevate privileges, or exfiltrate sensitive data. All organizations utilizing the ThemeGrill eStore plugin within the version range of n/a through 1.6.13 are at risk.

Recommendation

Prioritize the update of the ThemeGrill eStore plugin to the latest available version that resolves CVE-2026-108485. Security teams should audit web server logs for suspicious URL parameters containing encoded scripts or unusual characters often associated with XSS payloads, specifically targeting requests directed toward the eStore plugin endpoints. Ensure that a robust Web Application Firewall (WAF) is configured to detect and block common XSS patterns in URI parameters.