The vulnerability CVE-2026-25307 affects 8theme XStore Core plugin versions prior to 5.7. It is a DOM-based Cross-site Scripting issue caused by improper neutralization of input during web page generation. An attacker with low privileges and requiring user interaction can exploit this vulnerability remotely to execute arbitrary scripts in the context of the victim's browser session. The CVSS score is 6.5 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, user interaction needed, and partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to partial disclosure of information, modification of data, and limited disruption of service. The impact is limited by the requirement for user interaction and low privileges needed by the attacker. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting plugin usage to trusted users and environments. Monitor for updates from 8theme regarding patches or mitigations for this vulnerability.