Vendor

8theme

Products

CVEs

Across products

Status

Private

Products

Xstore Core
23 CVEs

Recent CVEs

View all 23 CVEs →

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-33551	8theme Xstore Core	Cri	0.60	9.3	0.01	Apr 29, 2024	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2024-33560	WordPress Xstore	Cri	0.59	9.0	0.01	Jun 4, 2024	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.
CVE-2024-33553	8theme Xstore Core	Cri	0.59	9.0	0.01	Apr 29, 2024	Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2025-11746	WordPress Xstore Core	Hig	0.57	8.8	0.01	Oct 15, 2025	The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute…
CVE-2025-64193	8theme Xstore Core	Hig	0.49	7.5	0.00	Dec 18, 2025	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.
CVE-2026-25306	8theme Xstore Core	Hig	0.46	7.1	0.00	Mar 25, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.
CVE-2025-64191	8theme Xstore Core	Hig	0.46	7.1	0.00	Dec 18, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.
CVE-2025-64189	8theme Xstore Core	Hig	0.46	7.1	0.00	Dec 18, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.
CVE-2024-33554	8theme Xstore Core	Hig	0.46	7.1	0.00	Apr 29, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2026-25307	8theme Xstore Core	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.
CVE-2026-25305	8theme Xstore Core	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.
CVE-2025-64190	8theme Xstore Core	Med	0.42	6.5	0.00	Dec 30, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.
CVE-2024-33558	8theme Xstore Core	Med	0.42	6.5	0.00	Apr 29, 2024	Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2025-64192	8theme Xstore Core	Med	0.41	6.3	0.00	Dec 18, 2025	Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.
CVE-2026-25006	8theme Xstore Core	Med	0.34	5.3	0.00	Feb 19, 2026	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.
CVE-2025-60100	8theme Xstore Core	Med	0.34	5.3	0.00	Sep 26, 2025	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
CVE-2024-33555	8theme Xstore Core		0.00	—	0.00	Jun 9, 2024	Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
CVE-2024-33561	8theme Xstore Core		0.00	—	0.00	Jun 9, 2024	Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
CVE-2024-33563	8theme Xstore Core		0.00	—	0.00	Jun 9, 2024	Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
CVE-2024-33564	8theme Xstore Core		0.00	—	0.00	Jun 9, 2024	Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

CVE-2024-33551CriApr 29, 2024
8theme
Xstore Core
risk 0.60cvss 9.3epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2024-33560CriJun 4, 2024
WordPress
Xstore
risk 0.59cvss 9.0epss 0.01
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.
CVE-2024-33553CriApr 29, 2024
8theme
Xstore Core
risk 0.59cvss 9.0epss 0.01
Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2025-11746HigOct 15, 2025
WordPress
Xstore Core
risk 0.57cvss 8.8epss 0.01
The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute…
CVE-2025-64193HigDec 18, 2025
8theme
Xstore Core
risk 0.49cvss 7.5epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.
CVE-2026-25306HigMar 25, 2026
8theme
Xstore Core
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.
CVE-2025-64191HigDec 18, 2025
8theme
Xstore Core
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.
CVE-2025-64189HigDec 18, 2025
8theme
Xstore Core
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.
CVE-2024-33554HigApr 29, 2024
8theme
Xstore Core
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2026-25307MedFeb 19, 2026
8theme
Xstore Core
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.
CVE-2026-25305MedFeb 19, 2026
8theme
Xstore Core
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.
CVE-2025-64190MedDec 30, 2025
8theme
Xstore Core
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.
CVE-2024-33558MedApr 29, 2024
8theme
Xstore Core
risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.
CVE-2025-64192MedDec 18, 2025
8theme
Xstore Core
risk 0.41cvss 6.3epss 0.00
Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.
CVE-2026-25006MedFeb 19, 2026
8theme
Xstore Core
risk 0.34cvss 5.3epss 0.00
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.
CVE-2025-60100MedSep 26, 2025
8theme
Xstore Core
risk 0.34cvss 5.3epss 0.00
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
CVE-2024-33555Jun 9, 2024
8theme
Xstore Core
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
CVE-2024-33561Jun 9, 2024
8theme
Xstore Core
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
CVE-2024-33563Jun 9, 2024
8theme
Xstore Core
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
CVE-2024-33564Jun 9, 2024
8theme
Xstore Core
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

View all 23 CVEs →