WordPress plugin
Jupiter X Core security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 28 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical5
- High8
- Medium15
- Low0
All Jupiter X Core vulnerabilities
- Medium5.3Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter
≤4.62.0Update to 4.63.0
- Medium5.9Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter
≤4.62.0Update to 4.63.0
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta
≤4.62.0Update to 4.63.0
- Critical9.8Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
≤4.61.0Update to 4.62.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
≤4.61.0Update to 4.62.0
- Medium5.3Missing Authorization
≤4.14.1Update to 4.14.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.14.1Update to 4.14.2
- High8.8Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
≤4.14.1Update to 4.14.2
- High7.5Authenticated (Contributor+) PHP Object Injection
≤4.10.1Update to 4.11.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.11.0Update to 4.11.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
≤4.8.12Update to 4.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.8.11Update to 4.8.12
- High8.1Unauthenticated PHP Object Injection via PHAR
≤4.8.11Update to 4.8.12
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
≤4.8.7Update to 4.8.8
- High8.8Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)
≤4.8.7Update to 4.8.8
- Medium5.3Missing Authorization to Unauthenticated Popup Template Export
≤4.8.5Update to 4.8.6
- Medium4.3Missing Authorization to Authenticated Library Sync
≤4.8.5Update to 4.8.6
- High8.1Limited Unauthenticated Authentication Bypass to Account Takeover
≤4.7.5Update to 4.7.8
- Critical9.8Unauthenticated Arbitrary File Upload
≤4.6.5Update to 4.6.6
- Critical9.8Unauthenticated Arbitrary File Upload
≤3.3.5Update to 3.3.8
- Critical9.8Unauthenticated Privilege Escalation
≤3.3.8Update to 3.4.3
- High8.33.3.0 - Missing Authorization
3.0.0 – 3.3.0Update to 3.3.5
- Medium4.33.3.0 - Missing Authorization
3.0.0 – 3.3.0Update to 3.3.5
- High7.5Unauthenticated Arbitrary File Download
≤4.6.6Update to 4.6.9
- High7.6Missing Authorization Checks
≤2.0.9Update to 2.1.0
- Medium6.3Information Disclosure, Modification, and Denial of Service
≤2.0.6Update to 2.0.7
- Critical9.9Authenticated Privilege Escalation
≤6.10.1Update to 6.10.2
- Medium6.5Authenticated Arbitrary Plugin Deactivation and Settings Modification
≤2.0.6Update to 2.0.7
Jupiter X Core: common questions
Does Jupiter X Core have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in Jupiter X Core: 5 critical, 8 high, 15 medium. None are known to affect version null.
How do I check which version of Jupiter X Core I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Jupiter X Core vulnerability?
CVE-2026-120555, published Nov 6, 2026: Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter. Severity: Medium (CVSS 5.3).
Is any Jupiter X Core vulnerability listed in CISA KEV?
No. None of the known Jupiter X Core vulnerabilities is currently listed in the CISA KEV catalog.