CVE-2025-60100
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
XSS vulnerability in the XStore theme for WordPress allows injection of HTML/JavaScript code into a web page. Affects versions up to and including 9.6.
Risk Assessment
An attacker can execute malicious scripts in the browser of an administrator or user, potentially leading to session theft, account takeover, or content modification.
Recommendation
Update the XStore theme to version 9.6 or later if available. Additionally, apply input filtering and output encoding mechanisms.
Other vulnerabilities in XStore
See all- CVE-2026-105065High
The XStore plugin for WordPress contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions prior to 9.7.9.
- CVE-2025-64192Medium
The XStore theme by 8theme is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions before 9.6.
Original NVD description (English source)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS