# cve.now: 8theme

The newest entries naming 8theme as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-25306](https://cve.now/CVE-2026-25306.md): WordPress XStore Core plugin \<= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-25307](https://cve.now/CVE-2026-25307.md): WordPress XStore Core plugin \< 5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-25305](https://cve.now/CVE-2026-25305.md): WordPress XStore theme \<= 9.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-25006](https://cve.now/CVE-2026-25006.md): WordPress XStore theme \<= 9.6.4 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3)
- [CVE-2025-64190](https://cve.now/CVE-2025-64190.md): WordPress XStore Core plugin \< 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64193](https://cve.now/CVE-2025-64193.md): WordPress XStore theme \< 9.6.1 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64192](https://cve.now/CVE-2025-64192.md): WordPress XStore theme \< 9.6 - Broken Access Control vulnerability (CVSS 6.3)
- [CVE-2025-64191](https://cve.now/CVE-2025-64191.md): WordPress XStore theme \< 9.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-64189](https://cve.now/CVE-2025-64189.md): WordPress XStore Core plugin \< 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-11746](https://cve.now/CVE-2025-11746.md): XStore | Multipurpose WooCommerce Theme \<= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion (CVSS 8.8)
- [CVE-2025-60100](https://cve.now/CVE-2025-60100.md): WordPress XStore theme \< 9.6 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2024-33555](https://cve.now/CVE-2024-33555.md): WordPress XStore Core plugin \<= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability (CVSS 8.1)
- [CVE-2024-33561](https://cve.now/CVE-2024-33561.md): WordPress XStore theme \<= 9.3.8 - Unauthenticated Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2024-33563](https://cve.now/CVE-2024-33563.md): WordPress XStore theme \<= 9.3.8 - Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2024-33564](https://cve.now/CVE-2024-33564.md): WordPress XStore theme \<= 9.3.8 - Arbitrary Option Update vulnerability (CVSS 8.8)
- [CVE-2024-33560](https://cve.now/CVE-2024-33560.md): WordPress XStore theme \<= 9.3.8 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0)
- [CVE-2024-33557](https://cve.now/CVE-2024-33557.md): WordPress XStore Core plugin \<= 5.3.8 - Local File Inclusion vulnerability (CVSS 8.5)
- [CVE-2024-33552](https://cve.now/CVE-2024-33552.md): WordPress XStore Core plugin \<= 5.3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8)
- [CVE-2024-33556](https://cve.now/CVE-2024-33556.md): WordPress XStore Core plugin \<= 5.3.8 - Limited Arbitrary File Upload vulnerability (CVSS 8.2)
- [CVE-2024-33558](https://cve.now/CVE-2024-33558.md): WordPress XStore Core plugin \<= 5.3.5 - Limited Arbitrary File Download vulnerability (CVSS 6.5)
- [CVE-2024-33553](https://cve.now/CVE-2024-33553.md): WordPress XStore Core plugin \<= 5.3.5 - Unauthenticated PHP Object Injection vulnerability (CVSS 9.0)
- [CVE-2024-33551](https://cve.now/CVE-2024-33551.md): WordPress XStore Core plugin \<= 5.3.5 - Unauthenticated SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-33559](https://cve.now/CVE-2024-33559.md): WordPress XStore theme \<= 9.3.5 - Unauthenticated SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-33554](https://cve.now/CVE-2024-33554.md): WordPress XStore Core plugin \<= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-33562](https://cve.now/CVE-2024-33562.md): WordPress XStore theme \<= 9.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/8theme
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.