The 8theme XStore Core plugin (et-core-plugin) contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to 5.6.4. An attacker can craft a malicious URL or input that, when processed by the vulnerable plugin, results in execution of arbitrary scripts in the victim's browser. The CVSS v3.1 score is 7.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability (partial). No patch or official fix information is currently provided.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The attack requires user interaction (e.g., clicking a crafted link). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users to avoid clicking suspicious links. Monitor vendor channels for updates and apply patches promptly once released.