8.8
Élevée
CVE-2025-11746 The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via…
Description
The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| XStore 9.5 | premières → 9.5.4 | Pas de correctif indiqué |
Autres CVE de XStore
Les 13 CVE de XStore →
CVE-2026-25006
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore…
5.3
Moyenne
CVE-2026-25305
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore…
6.5
Moyenne
CVE-2025-64191
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore…
7.1
Élevée
CVE-2025-64192
Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control…
6.3
Moyenne