What’s Vulnerable › Products

8theme XStore Core vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your 8theme XStore Core version is affected

Latest 8theme XStore Core vulnerabilities

• CVE-2026-25306 — WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-25307 — WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-64190 — WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-64189 — WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2024-33555 — WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-33557 — WordPress XStore Core plugin <= 5.3.8 - Local File Inclusion vulnerability (CVSS 8.8)
• CVE-2024-33552 — WordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8)
• CVE-2024-33556 — WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability (CVSS 9.8)
• CVE-2024-33558 — WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability (CVSS 6.5)
• CVE-2024-33553 — WordPress XStore Core plugin <= 5.3.5 - Unauthenticated PHP Object Injection vulnerability (CVSS 9.8)
• CVE-2024-33554 — WordPress XStore Core plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-33551 — WordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerability (CVSS 9.8)