XStore Core

XStore Core has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 12 are fixed as of September 2026. Their average CVSS score is 7.7, and the most serious one scores 10.0 out of 10. Severity breakdown: 4 critical and 1 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (42%). Other recurring categories include Deserialization Of Untrusted Data, Improper Privilege Management.

Every one of the 12 issues recorded for XStore Core has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (8) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSHigh

7.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all XStore Core vulnerabilities before they are exploited.

Highest severity on recordCVSS 10.0CVE-2024-33551

XStore Core <= 5.3.8 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

12 records


2026-03-17 00:00	XStore Core <= 5.6.4 - Reflected Cross-Site Scripting XStore Core <= 5.6.4	`CVE-2026-25306`	6.1 Medium	João Pedro Soares de Alcântara	Yes
2026-01-19 00:00	XStore Core < 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting XStore Core < 5.7	`CVE-2026-25307`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-12-30 00:00	XStore Core < 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting XStore Core < 5.6	`CVE-2025-64190`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-10-17 00:00	XStore Core < 5.6 - Reflected Cross-Site Scripting XStore Core < 5.6	`CVE-2025-64189`	6.1 Medium	João Pedro Soares de Alcântara	Yes
2024-04-25 00:00	XStore Core <= 5.3.8 - Reflected Cross-Site Scripting XStore Core <= 5.3.8	`CVE-2024-33554`	6.1 Medium	Rafie Muhammad	Yes
2024-04-25 00:00	XStore Core <= 5.3.8 - Unauthenticated SQL Injection XStore Core <= 5.3.8	`CVE-2024-33551`	10.0 Critical	Rafie Muhammad	Yes
2024-04-25 00:00	XStore Core <= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Upload XStore Core <= 5.3.8	`CVE-2024-33556`	9.9 Critical	Rafie Muhammad	Yes
2024-04-25 00:00	XStore Core <= 5.3.8 - Missing Authorization XStore Core <= 5.3.8	`CVE-2024-33555`	6.3 Medium	Rafie Muhammad	Yes
2024-04-25 00:00	XStore Core <= 5.3.8 - Unauthenticated Privilege Escalation XStore Core <= 5.3.8	`CVE-2024-33552`	9.8 Critical	Rafie Muhammad	Yes
2024-04-25 00:00	XStore Core <= 5.3.8 - Authenticated (Subscriber+) Local File Inclusion XStore Core <= 5.3.8	`CVE-2024-33557`	8.8 High	Rafie Muhammad	Yes

Showing 1–10 of 12 reports