8theme

Records25All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

8theme records in CISA KEV

No 8theme vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Xstore Core 8 records MEDIUM Xstore 3 records MEDIUM

Records

8 records in Xstore Core · all components

TI-2024-22139 CVE-2024-33552 · GHSA-f2w4-4w88-537q

WordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerability

MEDIUM 50

Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00571 Published 2024-05-17 No fix listed CWE-269

TI-2024-22143 CVE-2024-33556 · GHSA-m34m-7f6x-5pmq

WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability

MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00583 Published 2024-05-17 No fix listed CWE-434

TI-2024-22138 CVE-2024-33551 · GHSA-349c-6q2h-wwhm

WordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerability

MEDIUM 49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2024-04-29 No fix listed CWE-89

TI-2024-22140 CVE-2024-33553 · GHSA-fwrh-xmxv-qj39

WordPress XStore Core plugin <= 5.3.5 - Unauthenticated PHP Object Injection vulnerability

MEDIUM 44

Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00576 Published 2024-04-29 No fix listed CWE-502

TI-2024-22144 CVE-2024-33557 · GHSA-qfjr-gjmj-rcfj

WordPress XStore Core plugin <= 5.3.8 - Local File Inclusion vulnerability

MEDIUM 41

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0056 Published 2024-06-04 No fix listed CWE-22

TI-2024-22142 CVE-2024-33555 · GHSA-pr3j-v5pq-pfv9

WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00417 Published 2024-06-09 No fix listed CWE-862

TI-2024-22141 CVE-2024-33554 · GHSA-894f-rh68-m2vm

WordPress XStore Core plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00421 Published 2024-04-29 No fix listed CWE-79

TI-2024-22145 CVE-2024-33558 · GHSA-gv7p-f5gp-mj9q

WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

LOW 29

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00435 Published 2024-04-29 No fix listed CWE-862

Open these records in search →

Critical	7
High	11
Medium	7
Low	0
No CVSS	0