Read the docs

8theme

Records25All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

8theme records in CISA KEV

No 8theme vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Xstore Core 8 records MEDIUM Xstore 3 records MEDIUM

Records

25 records

TI-2024-22146 CVE-2024-33559 · GHSA-g99q-g998-c275

WordPress XStore theme <= 9.3.5 - Unauthenticated SQL Injection vulnerability

Priority MEDIUM 54

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.03583 Published 2024-04-29 No fix listed CWE-89
TI-2024-22144 CVE-2024-33557 · GHSA-qfjr-gjmj-rcfj

WordPress XStore Core plugin <= 5.3.8 - Local File Inclusion vulnerability

Priority MEDIUM 41

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0056 Published 2024-06-04 No fix listed CWE-22
TI-2025-39636 CVE-2025-64193 · GHSA-g6hf-85r7-3mpx

WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability

Priority LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through <…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00458 Published 2025-12-18 No fix listed CWE-98
TI-2025-39634 CVE-2025-64191 · GHSA-3564-wvxg-qccv

WordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00219 Published 2025-12-18 No fix listed CWE-79
TI-2025-39632 CVE-2025-64189 · GHSA-5pmc-jr6h-w75f

WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00219 Published 2025-12-18 No fix listed CWE-79
TI-2026-20191 CVE-2026-25006 · GHSA-j9jq-xf7q-w5fq

WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability

Priority LOW 30

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00274 Published 2026-02-19 No fix listed CWE-80
TI-2025-37466 CVE-2025-60100 · GHSA-2mhq-48gx-32rg

WordPress XStore theme < 9.6 - Content Injection vulnerability

Priority LOW 30

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00292 Published 2025-09-26 No fix listed CWE-80
TI-2026-20425 CVE-2026-25307 · GHSA-vv37-5fmc-w362

WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00191 Published 2026-02-19 No fix listed CWE-79
TI-2026-20423 CVE-2026-25305 · GHSA-2f8f-8j4g-347v

WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00191 Published 2026-02-19 No fix listed CWE-79
TI-2025-39633 CVE-2025-64190 · GHSA-cv94-mq7f-9hch

WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00159 Published 2025-12-30 No fix listed CWE-79
TI-2025-39635 CVE-2025-64192 · GHSA-56hc-483g-7qv2

WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Priority LOW 27

Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00225 Published 2025-12-18 No fix listed CWE-862
Open these records in search →