Executive brief
JupiterX Core, a foundational component for the JupiterX WordPress theme, is vulnerable to a security flaw that allows users with low-level 'Subscriber' accounts to inject malicious scripts into the website. If an administrator or another user interacts with the affected area, the attacker's script could execute, potentially leading to unauthorized actions, data theft, or website defacement. This issue impacts the integrity of the site and the security of its visitors.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the JupiterX Core plugin for WordPress (versions up to and including 4.14.1) due to improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with Subscriber-level authentication can inject malicious HTML or JavaScript payloads. Successful exploitation requires a victim (typically a higher-privileged user) to interact with the affected page or perform a specific action, such as clicking a link. This can lead to session hijacking, unauthorized administrative actions, or redirection to malicious sites. The vulnerability is resolved in version 4.14.2.
Affected products
- Artbees JupiterX Core <= 4.14.1
Timeline
- 2026-01-18: other: Reported by Nguyen Ba Khanh
- 2026-04-13: advisory: Initial advisory published by Patchstack
- 2026-04-13: patched: Patch released in version 4.14.2
- 2026-06-15: disclosed: NVD publication date