Medium 6.4

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-10511 First seen on SecPulse Oct 27, 16:42

Affected packages

Ecosystem	Package	Affected	Fixed
artbees	Jupiter X Core	≤ 4.61.0	—

Original description The description as published by the source.

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.4; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: Oct 27, 2026
First seen on SecPulse: Oct 27, 16:42
GHSA: GHSA-c968-6384-5fxw
CWE: CWE-80

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

Attack Types

Cross-Site Scripting

CWE

CWE-80

All

Artbees Jupiter X Core

Detection sources

NIST National Vulnerability Database11:16
GitHub Security Advisories (Global)Oct 27, 18:31
CVE.org (CVE Program・cvelistV5)10:52