CVE-2026-25306
Published: 25 March 2026
Summary
CVE-2026-25306 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters information outputs during web page generation to neutralize malicious scripts reflected from user inputs, directly addressing the improper neutralization in this reflected XSS vulnerability.
Validates inputs to the WordPress plugin to block malicious payloads before they are processed and reflected in generated web pages.
Requires timely remediation of flaws through patching the vulnerable XStore Core plugin versions up to 5.6.4.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploiting the web app via crafted input/link). Injected JS facilitates T1185 (browser session hijacking), T1539 (stealing web session cookies), and T1550.004 (reusing stolen cookies as alternate auth material), matching the described client-side impacts.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.
Deeper analysisAI
CVE-2026-25306 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the 8theme XStore Core et-core-plugin for WordPress. This issue affects XStore Core versions from an unspecified initial release through 5.6.4.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by crafting inputs that reflect malicious scripts in web page generation, achieving low impacts on confidentiality, integrity, and availability with a changed scope, typically enabling client-side effects like session hijacking or data exfiltration in the victim's browser context.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/et-core-plugin/vulnerability/wordpress-xstore-core-plugin-5-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)