The flaw is an improper neutralization of script‑related HTML tags that lets an attacker embed malicious code through shortcodes rendered by the XStore theme. This basic XSS vulnerability can allow injection of arbitrary JavaScript into page content, compromising the integrity and confidentiality of the site for users who visit the affected pages. While it does not guarantee remote code execution on the server, the ability to execute code on the client side can be leveraged for phishing, defacement, or credential theft.

Every WordPress installation that uses the 8theme XStore theme version 9.6.4 or earlier is affected. The vulnerability applies to all releases starting from the earliest available to and including 9.6.4.

The CVSS score of 5.3 places this issue in the medium severity range, and the EPSS below 1% indicates a very low expected exploitation likelihood at present. It is not listed in CISA’s KEV catalog. The likely attack vector involves a remote actor who can insert or modify content—such as posts, pages, or comment submissions—that the theme processes without adequate sanitization. Authentication may be required to create or edit posts, but if public posting is enabled, it could be abused without credentials.