Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · jupiterx-core
JupiterX Core
21 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 27, 2026Jupiter X Core: Authentication BypassCVE-2026-106013 · affects up to 4.61.0 · reported by WordfenceCritical 9.8
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Oct 27, 2026Jupiter X Core: Stored Cross-Site ScriptingCVE-2026-10511 · affects up to 4.61.0 · reported by WordfenceMedium 6.4
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.CVE-2026-39490 · affects up to 4.14.1 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.CVE-2026-39491 · affects up to 4.14.1 · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
Mar 23, 2026Jupiter X Core: Limited file uploadsCVE-2026-3533 · affects up to 4.14.1 · reported by WordfenceHigh 8.8
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026JupiterX Core: Deserialization of Untrusted DataCVE-2025-50004 · affects up to 4.10.1 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
Sep 22, 2025JupiterX Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58264 · affects up to 4.11.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.11.0.
May 17, 2025Jupiter X Core: Stored Cross-Site ScriptingCVE-2025-3888 · affects up to 4.8.12 · reported by WordfenceMedium 6.4
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025JupiterX Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47475 · affects up to 4.8.11 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.8.11.
Apr 26, 2025Jupiter X Core: PHP Object InjectionCVE-2025-2105 · affects up to 4.8.11 · reported by WordfenceHigh 8.1
The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'raven_download_file' function. This makes it possible for attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with the file download action, and the ability to upload files is also present. Otherwise, this would be considered exploitable by Contributor-level users and above, because they could create the form needed to successfully exploit this.
Feb 1, 2025Jupiter X Core: Local File Inclusion to Remote Code ExecutionCVE-2025-0366 · affects up to 4.8.7 · reported by WordfenceHigh 8.8
The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_svg() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. In this specific case, an attacker can create a form that allows SVG uploads, upload an SVG file with malicious content and then include the SVG file in a post to achieve remote code execution. This means it is relatively easy to gain remote code execution as a contributor-level user and above by default.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 1, 2025Jupiter X Core: Directory TraversalCVE-2025-0365 · affects up to 4.8.7 · reported by WordfenceMedium 6.5
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Jan 7, 2025Jupiter X Core: Unauthorized access of dataCVE-2024-12316 · affects up to 4.8.5 · reported by WordfenceMedium 5.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Jupiter X Core: Unauthorized accessCVE-2024-12033 · affects up to 4.8.5 · reported by WordfenceMedium 4.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries
Dec 13, 2024JupiterX Core: Missing AuthorizationCVE-2023-38385 · affects up to 3.3.0 · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
Sep 26, 2024Jupiter X Core: Authentication bypassCVE-2024-7781 · affects up to 4.7.5 · reported by WordfenceHigh 8.1
The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Login widget. This makes it possible for unauthenticated attackers to log in as the first user to have logged in with a social media account, including administrator accounts. Attackers can exploit the vulnerability even if the Social Login element has been disabled, as long as it was previously enabled and used. The vulnerability was partially patched in version 4.7.5, and fully patched in version 4.7.8.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2024Jupiter X Core: Arbitrary file uploadsCVE-2024-7772 · affects up to 4.6.5 · reported by WordfenceCritical 9.8
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 21, 2024JupiterX Core: Incorrect AuthorizationCVE-2023-38389 · affects up to 3.3.8 · reported by PatchstackCritical 9.8
Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.
Jun 19, 2024JupiterX Core: Missing AuthorizationCVE-2023-38394 · affects up to 3.3.0 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
Mar 26, 2024JupiterX Core: Unrestricted Upload of File with Dangerous TypeCVE-2023-38388 · affects up to 3.3.5 · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5.
Jul 20, 2023Jupiter X Core: Arbitrary file downloadsCVE-2023-3813 · affects up to 4.6.6 · reported by WordfenceHigh 7.5
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.