XStore

XStore has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 10.0 out of 10. Severity breakdown: 2 critical and 4 high. 2024 was the busiest year with 6 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (29%). Other recurring categories include Cross-Site Scripting, Code Injection.

Every one of the 14 issues recorded for XStore has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (10) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

7.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all XStore vulnerabilities before they are exploited.

Highest severity on recordCVSS 10.0CVE-2024-33559

XStore <= 9.3.8 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

14 records


2026-06-11 00:00	XStore < 9.7.3 - Unauthenticated SQL Injection XStore < 9.7.3	`CVE-2026-3326`	7.5 High	Ahmed Makawi	Yes
2026-01-18 00:00	XStore <= 9.6.4 - Unauthenticated Arbitrary Shortcode Execution XStore <= 9.6.4	`CVE-2026-25006`	6.5 Medium	João Pedro Soares de Alcântara	Yes
2026-01-18 00:00	XStore <= 9.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting XStore <= 9.6.4	`CVE-2026-25305`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-10-14 14:24	XStore \| Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion XStore <= 9.5.4	`CVE-2025-11746`	8.8 High	khanhhnahk1	Yes
2025-09-26 00:00	XStore < 9.6 - Unauthenticated Arbitrary Shortcode Execution XStore < 9.6	`CVE-2025-60100`	6.5 Medium	Rafie Muhammad	Yes
2025-09-10 00:00	XStore < 9.6.1 - Authenticated (Subscriber+) Local File Inclusion XStore < 9.6.1	`CVE-2025-64193`	7.5 High	Rafie Muhammad	Yes
2025-09-10 00:00	XStore < 9.6 - Missing Authorization XStore < 9.6	`CVE-2025-64192`	4.3 Medium	Rafie Muhammad	Yes
2025-09-10 00:00	XStore < 9.6.1 - Reflected Cross-Site Scripting XStore < 9.6.1	`CVE-2025-64191`	6.1 Medium	Rafie Muhammad	Yes
2024-04-25 00:00	XStore <= 9.3.8 - Missing Authorization XStore <= 9.3.8	`CVE-2024-33561`	5.3 Medium	Rafie Muhammad	Yes
2024-04-25 00:00	XStore <= 9.3.8 - Authenticated (Subscriber+) Arbitrary Options Update XStore <= 9.3.8	`CVE-2024-33564`	8.8 High	Rafie Muhammad	Yes

Showing 1–10 of 14 reports