This vulnerability in 8theme XStore (versions before 9.6) is caused by improper neutralization of script-related HTML tags in web pages, leading to a basic cross-site scripting (XSS) flaw. The issue allows an attacker to inject code remotely without authentication or user interaction, potentially exposing confidential information. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to disclosure of confidential information. The vulnerability does not affect integrity or availability. Since no exploits are known in the wild, the immediate risk appears limited but should be monitored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor communications for updates on patches or mitigations.