CVE-2022-1656

CVE-2022-1656 affects JupiterX Theme and JupiterX Core Plugin (versions

CVE-2023-38388

CVE-2023-38388 affects WordPress JupiterX Core plugin (

CVE-2023-38389

CVE-2023-38389 affects JupiterX Core (WordPress plugin) and is a Privilege Escalation via Incorrect Authorization in versions up to and including 3.3.8. The root cause is improper access control that allows unauthenticated users to access restricted functionality, enabling an account takeover sce...

CVE-2024-7772

The Jupiter X Core WordPress plugin (Jupiter X Core) is affected by CVE-2024-7772: an unauthenticated arbitrary file upload vulnerability caused by mishandled file type validation in the validate function, impacting all versions up to and including 4.6.5. Exploitation can allow uploading arbitrar...

CVE-2025-0366

CVE-2025-0366 refers to a Local File Inclusion/Remote Code Execution vulnerability in Jupiter X Core for WordPress (affected versions

CVE-2024-7781

CVE-2024-7781 concerns Jupiter X Core for WordPress. The records show an authentication bypass in all versions up to and including 4.7.5, enabling unauthenticated attackers to log in as the first user who logged in via a social media account (potentially an admin). The vulnerability can be exploi...

CVE-2025-2105

CVE-2025-2105 (Jupiter X Core) affects WordPress Jupiter X Core plugin up to version 4.8.11. Vulnerability: PHP Object Injection via deserialization of untrusted input from the ‘file’ parameter of raven_download_file, enabling injection of a PHP object through a PHAR file. Impact is contingent on...

CVE-2025-0365

CVE-2025-0365 : Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.8.7 via the inline SVG feature. An authenticated attacker with Contributor-level access or higher can read arbitrary server files, potentially exposing sensitive informat...

CVE-2023-3813

CVE-2023-3813 affects Jupiter X Core for WordPress. Versions up to and including 2.5.0 are vulnerable to unauthenticated arbitrary file downloads from the server, potentially exposing sensitive contents. The vulnerability is related to Jupiter X Core’s handling of file access and is described as ...

CVE-2023-38385

CVE-2023-38385 affects WordPress JupiterX Core plugin (versions 3.0.0–3.3.0). The root cause is Missing Authorization, i.e., an incorrectly configured access control security level that allows unauthorized access. CVSS v3.1 metrics indicate Attack Vector: Network, Attack Complexity: Low, Privileg...

CVE-2024-12033

CVE-2024-12033 affects the WordPress plugin Jupiter X Core (versions up to 4.8.5). Likely root cause: missing capability check in sync_libraries(), enabling authenticated users with Subscriber+ to trigger library syncs. Red Hat and Wordfence Toxic entries confirm the flaw exists and that a patch ...

CVE-2023-38394

CVE-2023-38394 affects JupiterX Core plugin for WordPress (versions 3.0.0–3.3.0). The underlying issue is Missing Authorization / Broken Access Control, allowing access to restricted functionality for subscribers. Patch or mitigation: update JupiterX Core to 3.3.5 or newer, which fixes the vulner...

CVE-2024-12316

CVE-2024-12316: Jupiter X Core (WordPress) is vulnerable to unauthorized data access due to a missing capability check in export_popup_action() across all versions up to and including 4.8.5, enabling unauthenticated attackers to export popup templates. Connected sources confirm the issue and indi...

CVE-2025-3888

CVE-2025-3888 — Jupiter X Core (WordPress) stored XSS via inline SVG . The vulnerability affects Jupiter X Core versions up to and including 4.8.12, caused by insufficient input sanitization and output escaping for SVG content. An authenticated attacker with Contributor-level access or higher can...