8theme vulnerabilities and threats

26 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.1%	CVE-2026-105065XStore (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-10-15CVE Database V5CVE-2026-105065 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9. EPSS 0.1%Vulnerability 8theme.com	CVE Database V5	2026-10-15
High	7.1	EPSS 0.2%	CVE-2026-25306XStore Core (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-03-25CVE Database V5CVE-2026-25306 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2026-03-25
Medium	6.5	EPSS 0.2%	CVE-2026-25307XStore Core (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-02-19CVE Database V5CVE-2026-25307 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2026-02-19
Medium	6.5	EPSS 0.2%	CVE-2026-25305XStore (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-02-19CVE Database V5CVE-2026-25305 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2026-02-19
Medium	5.3	EPSS 0.3%	CVE-2026-25006XStore (WordPress plugin) · Basic XSS Medium5.3EPSS 0.3%2026-02-19CVE Database V5CVE-2026-25006 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4. EPSS 0.3%Vulnerability 8theme	CVE Database V5	2026-02-19
Medium	6.5	EPSS 0.2%	CVE-2025-64190XStore Core (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-12-30CVE Database V5CVE-2025-64190 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2025-12-30
High	7.5	EPSS 0.5%	CVE-2025-64193XStore (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.5%2025-12-18CVE Database V5CVE-2025-64193 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1. EPSS 0.5%Vulnerability 8theme	CVE Database V5	2025-12-18
Medium	6.3	EPSS 0.2%	CVE-2025-64192XStore (WordPress plugin) · Missing Authorization Medium6.3EPSS 0.2%2025-12-18CVE Database V5CVE-2025-64192 Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2025-12-18
High	7.1	EPSS 0.2%	CVE-2025-64191XStore (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-12-18CVE Database V5CVE-2025-64191 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2025-12-18
High	7.1	EPSS 0.2%	CVE-2025-64189XStore Core (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-12-18CVE Database V5CVE-2025-64189 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6. EPSS 0.2%Vulnerability 8theme	CVE Database V5	2025-12-18
High	8.8	EPSS 0.7%	CVE-2025-11746XStore (WordPress theme) · Path Traversal High8.8EPSS 0.7%2025-10-15CVE Database V5CVE-2025-11746 The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. EPSS 0.7%Vulnerability 8theme CWE-22	CVE Database V5	2025-10-15
Medium	5.3	EPSS 0.3%	CVE-2025-60100XStore (WordPress plugin) · Basic XSS Medium5.3EPSS 0.3%2025-09-26CVE Database V5CVE-2025-60100 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6. EPSS 0.3%Vulnerability 8theme CWE-80	CVE Database V5	2025-09-26
High	8.1	EPSS 0.4%	CVE-2024-33555XStore Core (WordPress plugin) · Missing Authorization High8.1EPSS 0.4%2024-06-09CVE Database V5CVE-2024-33555 Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8. EPSS 0.4%Vulnerability 8theme CWE-862	CVE Database V5	2024-06-09
High	7.5	EPSS 0.4%	CVE-2024-33561XStore (WordPress plugin) · Missing Authorization High7.5EPSS 0.4%2024-06-09CVE Database V5CVE-2024-33561 Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8. EPSS 0.4%Vulnerability 8theme CWE-862	CVE Database V5	2024-06-09
High	7.6	EPSS 0.4%	CVE-2024-33563XStore (WordPress plugin) · Missing Authorization High7.6EPSS 0.4%2024-06-09CVE Database V5CVE-2024-33563 Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8. EPSS 0.4%Vulnerability 8theme CWE-862	CVE Database V5	2024-06-09
High	8.8	EPSS 0.3%	CVE-2024-33564XStore (WordPress plugin) · Missing Authorization High8.8EPSS 0.3%2024-06-09CVE Database V5CVE-2024-33564 Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8. EPSS 0.3%Vulnerability 8theme CWE-862	CVE Database V5	2024-06-09
Critical	9.0	EPSS 0.6%	CVE-2024-33560XStore (WordPress plugin) · Path Traversal Critical9.0EPSS 0.6%2024-06-04CVE Database V5CVE-2024-33560 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8. EPSS 0.6%Vulnerability 8theme CWE-22	CVE Database V5	2024-06-04
High	8.5	EPSS 0.6%	CVE-2024-33557XStore Core (WordPress plugin) · Path Traversal High8.5EPSS 0.6%2024-06-04CVE Database V5CVE-2024-33557 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8. EPSS 0.6%Vulnerability 8theme CWE-22	CVE Database V5	2024-06-04
Critical	9.8	EPSS 0.6%	CVE-2024-33552XStore Core (WordPress plugin) · Improper Privilege Management Critical9.8EPSS 0.6%2024-05-17CVE Database V5CVE-2024-33552 Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8. EPSS 0.6%Vulnerability 8theme CWE-269	CVE Database V5	2024-05-17
High	8.2	EPSS 0.6%	CVE-2024-33556XStore Core (WordPress plugin) · Unrestricted File Upload High8.2EPSS 0.6%2024-05-17CVE Database V5CVE-2024-33556 Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8. EPSS 0.6%Vulnerability 8theme CWE-434	CVE Database V5	2024-05-17

Page 1 of 2