CVE-2026-105065

WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress-extensions

Products

Xstore Xstore

CVE-2024-33562

WordPress XStore theme <= 9.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore allows Reflected XSS.This issue affects XStore: from n/a through 9.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme

Products

Xstore

CVE-2024-33551

WordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

8theme

Products

Xstore Core

CVE-2024-33558

WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

8theme

Products

Xstore Core

CVE-2024-33559

WordPress XStore theme <= 9.3.5 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.

CVSS 3.1 · 9.3 Critical EPSS 3.6% KEV · Not listed

Vendors

8theme

Products

Xstore

CVE-2024-33553

WordPress XStore Core plugin <= 5.3.5 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

8theme

Products

Xstore Core

CVE-2024-33554

WordPress XStore Core plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme

Products

Xstore Core

CVE-2025-64189

WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Core Wordpress

CVE-2025-64191

WordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2025-64193

WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2026-25006

WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2026-25306

WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Core Wordpress

CVE-2025-64190

WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Core Wordpress

CVE-2025-60100

WordPress XStore theme < 9.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2025-11746

XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion

The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2026-25305

WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2026-25307

WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Core Wordpress

CVE-2024-33560

WordPress XStore theme <= 9.3.8 - Unauthenticated Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2025-64192

WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Wordpress

CVE-2024-33556

WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

8theme

Products

Xstore Core