8Theme Xstore vulnerabilities

CVE-2024-33559 [CRITICAL] CWE-89 CVE-2024-33559: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.

CVE-2025-11746 [HIGH] CWE-22 CVE-2025-11746: The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code i

CVE-2024-33560 [CRITICAL] CWE-22 CVE-2024-33560: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8the Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.

CVE-2024-33563 [HIGH] CWE-862 CVE-2024-33563: Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3 Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

CVE-2024-33561 [CRITICAL] CWE-862 CVE-2024-33561: Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3 Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

CVE-2025-64193 [HIGH] CWE-98 CVE-2025-64193: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.

CVE-2025-64192 [MEDIUM] CWE-862 CVE-2025-64192: Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.

CVE-2025-60100 [MEDIUM] CWE-80 CVE-2025-60100: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8them Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

CVE-2025-64191 [HIGH] CWE-79 CVE-2025-64191: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.

CVE-2026-25006 [MEDIUM] CWE-80 CVE-2026-25006: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8them Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.

CVE-2024-33562 [HIGH] CWE-79 CVE-2024-33562: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore allows Reflected XSS.This issue affects XStore: from n/a through 9.3.5.

CVE-2026-25305 [MEDIUM] CWE-79 CVE-2026-25305: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.

CVE-2024-33564 [MEDIUM] CWE-862 CVE-2024-33564: Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3 Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.