CVE-2026-39490 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. |
CVE-2026-39491 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions. |
CVE-2026-3533 | High | 8.8 | 2026-03-24 | The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insu… |
CVE-2025-50004 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a throu… |
CVE-2025-58264 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.Thi… |
CVE-2025-3888 | Medium | 6.4 | 2025-05-17 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to… |
CVE-2025-47475 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.Thi… |
CVE-2025-2105 | High | 8.1 | 2025-04-26 | The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted inp… |
CVE-2025-0366 | High | 8.8 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_… |
CVE-2025-0365 | Medium | 6.5 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes… |
CVE-2024-12316 | Medium | 5.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in… |
CVE-2024-12033 | Medium | 4.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions… |
CVE-2023-38385 | High | 8.3 | 2024-12-13 | Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jupiter… |
CVE-2024-7781 | High | 8.1 | 2024-09-26 | The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authenticat… |
CVE-2024-7772 | Critical | 9.8 | 2024-09-26 | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all vers… |
CVE-2023-38389 | Critical | 9.8 | 2024-06-21 | Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core… |
CVE-2023-38394 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0. |
CVE-2024-4608 | Medium | 6.4 | 2024-06-06 | The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-30509 | Medium | 6.5 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Artbees SellKit allows Relative Path Traversal.This issue affec… |
CVE-2023-32110 | High | 7.6 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue aff… |
CVE-2023-38388 | Critical | 9.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5. |
CVE-2023-3813 | High | 7.5 | 2023-07-21 | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthent… |
CVE-2022-1659 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the i… |
CVE-2022-1658 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via t… |
CVE-2022-1657 | High | 8.8 | 2022-06-13 | Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversa… |
CVE-2022-1654 | High | 8.8 | 2022-06-13 | Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administ… |
CVE-2022-1656 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in li… |