CVE-2025-64192
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The XStore theme by 8theme is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions before 9.6.
Risk Assessment
An attacker can access functions or data they should not have permissions for, potentially leading to unauthorized changes or information disclosure.
Recommendation
Update the XStore theme to version 9.6 or later, which includes the fix. Review permission configuration and restrict access.
Other vulnerabilities in XStore
See all- CVE-2026-105065High
The XStore plugin for WordPress contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions prior to 9.7.9.
- CVE-2025-60100Medium
XSS vulnerability in the XStore theme for WordPress allows injection of HTML/JavaScript code into a web page. Affects versions up to and including 9.6.
Original NVD description (English source)
Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS