Jupiter X Core Plugin Vulnerability (CVE-2026-10511)

5 days ago

On this page

Security Alert Summary

The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the forget_password_link parameter. In affected versions up to and including 4.61.0, insufficient input sanitization and output escaping allow an authenticated attacker with contributor-level access or higher to inject JavaScript that will execute when an injected page is viewed.

CVE Details

CVE ID: CVE-2026-10511
Affected component: Jupiter X Core plugin for WordPress
Affected versions: All versions up to and including 4.61.0
Published: October 27, 2026 at 8:16:52 AM
Last modified: October 27, 2026 at 2:52:13 PM
CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authentication / privileges / user interaction: Requires an authenticated user with low privileges (PR:L). The public data notes contributor-level access and above can exploit the issue. User interaction is not required (UI:N).
Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
Weakness: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page)

Technical Details

The vulnerability is a stored XSS in the forget_password_link parameter of the Jupiter X Core plugin. Input provided to this parameter is not properly sanitized on input and is not escaped on output, allowing HTML or script content to be stored and later rendered in pages. The issue is present in the plugin code paths that handle the login widget (see includes/extensions/raven/includes/modules/forms/widgets/login.php in the provided references).

Because the payload is stored, injected script runs whenever a user views the affected page. The public description specifies that an authenticated attacker with contributor-level access or higher can perform the injection. Impact is limited to actions possible via script execution in the context of a viewer’s browser, such as reading data available to the page or performing actions permitted to that user in the browser context.

How This Could Impact Your Website

Imagine a site where a contributor or an external contractor can edit or submit content that is rendered by the site login or form widgets. An attacker who can inject script through the forget_password_link parameter could cause that script to execute when administrators, editors, or other users view the affected page. Practical consequences include exposure of information visible to the page (for example, internal user email addresses), session-based data accessible in the browser, or the ability to display misleading content to site users.

That exposure can increase the risk of targeted phishing or social-engineering campaigns against staff or contractors who routinely visit the site. If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

Update the affected plugin as soon as a patched version is available.
Review and reduce unnecessary user roles, especially contributor-level accounts and any external contractors with editing privileges.
Enforce strong passwords and two-factor authentication for editors and administrators.
Remove unused or unmaintained plugins and themes.
Monitor site activity and logs for unusual behavior, including unexpected content changes to forms or login-related widgets.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughi https://freshysites.com/team/nick-paliughi/

Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.