The vulnerability CVE-2026-25006 in 8theme XStore (<= 9.6.4) is a basic cross-site scripting (XSS) flaw caused by improper neutralization of script-related HTML tags in web pages. This allows an attacker to inject code into the affected web pages. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official remediation information is currently available.

The vulnerability allows an attacker to inject script code into web pages served by the affected XStore versions, potentially leading to integrity issues such as unauthorized script execution in users' browsers. There is no direct impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.