Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-23
Xstore - SQL Injection (CVE-2026-3326)
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
THEME
Xstore
CVE-2026-3326
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Cross-Site Scripting (XSS) (CVE-2026-25305)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through
THEME
Xstore
CVE-2026-25305
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Remote Code Execution (CVE-2026-25006)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through
THEME
Xstore
CVE-2026-25006
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Path Traversal (CVE-2025-64193)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.
THEME
Xstore
CVE-2025-64193
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Cross-Site Scripting (XSS) (CVE-2025-64191)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.
THEME
Xstore
CVE-2025-64191
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Broken Access Control (CVE-2025-64192)
Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.
THEME
Xstore
CVE-2025-64192
Risk Score
Threat Entry
Updated 2026-06-17
XStore - Path Traversal (CVE-2025-11746)
The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
THEME
XStore
CVE-2025-11746
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Remote Code Execution (CVE-2025-60100)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
THEME
Xstore
CVE-2025-60100
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Broken Access Control (CVE-2024-33564)
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
PLUGIN
Xstore
CVE-2024-33564
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Broken Access Control (CVE-2024-33563)
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
PLUGIN
Xstore
CVE-2024-33563
Risk Score
Threat Entry
Updated 2026-06-17
Xstore - Broken Access Control (CVE-2024-33561)
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
PLUGIN
Xstore
CVE-2024-33561
Risk Score