CVE-2026-10511

MediumCVSS 6.4

Published: 27/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to and including 4.61.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

Risk Assessment

An attacker with a contributor account can execute malicious JavaScript in visitors' browsers, potentially leading to session theft, administrator account takeover, or site content modification.

Recommendation

Update the Jupiter X Core plugin to a version later than 4.61.0; until then, limit contributor-level accounts and monitor their activity.

Other vulnerabilities in Jupiter X Core

CVE-2026-106013Critical
The Jupiter X Core plugin for WordPress (up to and including 4.61.0) is vulnerable to authentication bypass in its Twitter/X social login handler. The verify_twitter_callback function fails to reassign the returned credentials to the TwitterOAuth client, so the subsequent API call remains signed with the site operator's stored token, and the plugin authenticates a WordPress account based solely on the X app owner's email address.

Original NVD description (English source)

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS