Remote File Inclusion Vulnerability in 8theme XStore Theme
CVE-2025-64193

7.5HIGH

Key Information:

Vendor

WordPress
Status
Xstore
Vendor
CVE Published:
18 December 2025

What is CVE-2025-64193?

A vulnerability exists in the 8theme XStore theme that allows for improper control of filename inclusion. This flaw exposes the application to Local File Inclusion attacks, enabling an attacker to potentially execute arbitrary code by including files from the server or remote locations. The issue affects XStore versions from n/a through less than 9.6.1, necessitating prompt updates to mitigate risks and enhance security.

Affected Version(s)

XStore 0 <= 9.6.1

References

https://patchstack.com/database/Wordpress/Theme/xstore/vu...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.