Xstore
Monthly
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.
Missing Authorization vulnerability in 8theme XStore.3.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in 8theme XStore.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in 8theme XStore.3.8. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.
Missing Authorization vulnerability in 8theme XStore.3.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in 8theme XStore.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in 8theme XStore.3.8. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.