CVE-2026-25307

WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability

Published Feb 19, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.

Analysis

Technical impact

This vulnerability arises from improper input sanitization in the 8theme XStore Core plugin, allowing attackers to inject and execute malicious scripts in users' browsers during page rendering. The flaw is a DOM‑based Cross‑Site Scripting (XSS) vulnerability.

Affected Systems

The affected product is 8theme XStore Core for WordPress, specifically versions up to but not including 5.7. Users running any pre‑5.7 release are vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk, while the EPSS score of less than 1% suggests a low probability of exploitation so far and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker could use a crafted URL or form input that the browser processes, executing attacker‑supplied JavaScript within the context of the site. Attacks are client‑side and require victim interaction, such as clicking a link or visiting an injected page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

8theme

XStore Core

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.7

No data.

Vendor Product Versions

8theme

Xstore Core

Version	Status	Scheme	Platform
`[0,5.7)`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the XStore Core plugin to version 5.7 or later.
If the upgrade cannot be performed immediately, consider disabling the plugin or restricting its usage to trusted users.
Deploy a web application firewall or input validation rules that block JavaScript payloads in user input.

Generated by OpenCVE AI on April 16, 2026 at 17:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.196% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/et-core-plugin/vulnerability/wordpress-xstore-core-plugin-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Feb 20, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 20, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Feb 20, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		8theme 8theme xstore Core Wordpress Wordpress wordpress
Vendors & Products		8theme 8theme xstore Core Wordpress Wordpress wordpress

Feb 19, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.
Title		WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/Wordpress/Plugin/et-core-plugin/vulnerability/wordpress-xstore-core-plugin-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve