Vulnerabilities

TI-2025-03435 CVE-2025-3888 · GHSA-q55j-hjhh-8278

Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG

LOW 28

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00336 Published 2025-05-17 No fix listed CWE-79

TI-2025-01842 CVE-2025-2105 · GHSA-4gp3-vjp8-9r2q

Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR

LOW 39

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'raven_download_file' fun…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00786 Published 2025-04-26 No fix listed CWE-502

TI-2025-00297 CVE-2025-0365 · GHSA-726f-wm9m-23wf

Jupiterx Core <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read

LOW 30

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00725 Published 2025-02-01 No fix listed CWE-22

TI-2025-00298 CVE-2025-0366 · GHSA-pq7v-v662-6pp7

Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)

MEDIUM 43

The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_svg() function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01634 Published 2025-02-01 No fix listed CWE-98

TI-2024-11164 CVE-2024-12033 · GHSA-v9p2-r57p-mjxc

Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync

LOW 20

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions up to, and including, 4.8.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00297 Published 2025-01-07 No fix listed CWE-862

TI-2024-11426 CVE-2024-12316 · GHSA-86f3-wr96-fm48

Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export

LOW 30

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in all versions up to, and including, 4.8.5.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00423 Published 2025-01-07 No fix listed CWE-862

TI-2023-19769 CVE-2023-38385 · GHSA-756v-rcmm-vwxh

WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0059 Published 2024-12-13 No fix listed CWE-862

TI-2024-07214 CVE-2024-7781 · GHSA-qm25-6w48-7h5h

Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover

MEDIUM 45

The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00953 Published 2024-09-26 No fix listed CWE-288

TI-2024-07206 CVE-2024-7772 · GHSA-hr8m-c45c-9928

Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload

MEDIUM 52

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01506 Published 2024-09-26 No fix listed CWE-434

TI-2023-19773 CVE-2023-38389 · GHSA-6hqp-gvp9-rmv9

WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability

MEDIUM 45

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01406 Published 2024-06-21 No fix listed CWE-863

TI-2023-19778 CVE-2023-38394 · GHSA-fm33-4xh5-vw6v

WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00434 Published 2024-06-19 No fix listed CWE-862

TI-2023-19772 CVE-2023-38388 · GHSA-q77j-868w-97cc

WordPress Jupiter X Core plugin <= 3.3.5 - Unauth. Arbitrary File Upload vulnerability

MEDIUM 46

Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01698 Published 2024-03-26 No fix listed CWE-434

TI-2023-03564 CVE-2023-3813 · GHSA-vx6p-6hc5-p7cr

Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download

MEDIUM 41

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01219 Published 2023-07-21 No fix listed CWE-22

TI-2022-01526 CVE-2022-1656 · GHSA-6g9j-hm42-h45p

Improper access control in artbees Jupiter X Core

LOW 25

Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_a…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00543 Published 2022-06-13 No fix listed CWE-284

Vulnerabilities

Filters