8theme XStore vulnerabilities

Latest 8theme XStore CVEs

Newest publication first

1. CVE-2026-25006 WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability

   Published 2026-02-19

   Medium·CVSS 5.3 EPSS 0.27%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.

2. CVE-2026-25305 WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability

   Published 2026-02-19

   Medium·CVSS 6.5 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.

3. CVE-2025-64191 WordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-18

   High·CVSS 7.1 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.

4. CVE-2025-64192 WordPress XStore theme < 9.6 - Broken Access Control vulnerability

   Published 2025-12-18

   Medium·CVSS 6.3 EPSS 0.22%

   Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.

5. CVE-2025-64193 WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability

   Published 2025-12-18

   High·CVSS 7.5 EPSS 0.46%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.

6. CVE-2025-11746 XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion

   Published 2025-10-15

   High·CVSS 8.8 EPSS 0.73%

   The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute ar...

7. CVE-2025-60100 WordPress XStore theme < 9.6 - Content Injection vulnerability

   Published 2025-09-26

   Medium·CVSS 5.3 EPSS 0.29%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

8. CVE-2024-33561 WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability

   Published 2024-06-09

   Critical·CVSS 9.8 EPSS 0.43%

   Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

9. CVE-2024-33563 WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability

   Published 2024-06-09

   High·CVSS 8.8 EPSS 0.35%

   Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

10. CVE-2024-33564 WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability

    Published 2024-06-09

    Medium·CVSS 4.3 EPSS 0.32%

    Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

11. CVE-2024-33560 WordPress XStore theme <= 9.3.8 - Unauthenticated Local File Inclusion vulnerability

    Published 2024-06-04

    Critical·CVSS 9.0 EPSS 0.60%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.

12. CVE-2024-33559 WordPress XStore theme <= 9.3.5 - Unauthenticated SQL Injection vulnerability

    Published 2024-04-29

    Critical·CVSS 9.3 EPSS 3.6% Public exploit

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.

13. CVE-2024-33562 WordPress XStore theme <= 9.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2024-04-29

    High·CVSS 7.1 EPSS 0.42%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore allows Reflected XSS.This issue affects XStore: from n/a through 9.3.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.