Plugin icon

Jupiter X Core

jupiterx-core

Vulnerabilities:

18

Last Updated:

March 19, 2026

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2026-03-23
Title
JupiterX Core < 4.14.2 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
Fixed in
Fixed in 4.14.2
CVSS
8.8 (high)
Published
2026-01-12
Title
JupiterX Core < 4.11.0 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.11.0
CVSS
7.5 (high)
Published
2025-09-22
Title
JupiterX Core < 4.11.1 - Contributor+ Stored XSS
Fixed in
Fixed in 4.11.1
CVSS
5.9 (medium)
Published
2025-05-16
Title
Jupiterx Core < 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
Fixed in
Fixed in 4.9.1
CVSS
6.4 (medium)
Published
2025-05-07
Title
JupiterX Core < 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.8.12
CVSS
6.4 (medium)
Published
2025-04-25
Title
Jupiter X Core < 4.8.12 - Unauthenticated PHP Object Injection via PHAR
Fixed in
Fixed in 4.8.12
CVSS
8.1 (high)
Published
2025-01-31
Title
Jupiter X Core < 4.8.8 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)
Fixed in
Fixed in 4.8.8
CVSS
8.8 (high)
Published
2025-01-31
Title
Jupiterx Core < 4.8.8 - Authenticated (Contributor+) Arbitrary File Read
Fixed in
Fixed in 4.8.8
CVSS
6.5 (medium)
Published
2025-01-06
Title
Jupiter X Core < 4.8.6 - Missing Authorization to Unauthenticated Popup Template Export
Fixed in
Fixed in 4.8.6
CVSS
5.3 (medium)
Published
2025-01-06
Title
Jupiter X Core < 4.8.6 - Missing Authorization to Authenticated Library Sync
Fixed in
Fixed in 4.8.6
CVSS
4.3 (medium)
Published
2024-09-25
Title
Jupiter X Core < 4.7.8 - Limited Unauthenticated Authentication Bypass to Account Takeover
Fixed in
Fixed in 4.7.8
CVSS
8.1 (high)
Published
2024-08-23
Title
Jupiter X Core < 4.6.6 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 4.6.6
CVSS
9.8 (critical)
Published
2023-08-22
Title
Jupiter X Core Premium < 3.3.8 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 3.3.8
CVSS
9.0 (critical)
Published
2023-08-22
Title
Jupiter X Core Premium < 3.4.3 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 3.4.3
CVSS
9.8 (critical)
Published
2023-07-20
Title
Jupiter X Core < 4.6.9 - Unauthenticated Arbitrary File Download
Fixed in
Fixed in 4.6.9
CVSS
7.5 (high)
Published
2022-05-18
Title
JupiterX < 2.0.7 & JupiterX Core < 2.0.7 - Subscriber+ Arbitrary Plugin Deactivation and Settings Update
Fixed in
Fixed in 2.0.7
CVSS
6.5 (medium)
Published
2022-05-18
Title
Jupiter < 6.10.2 & JupiterX Core < 2.0.8 - Subscriber+ Privilege Escalation and Post Deletion
Fixed in
Fixed in 2.0.8
CVSS
9.9 (critical)
Published
2022-05-18
Title
JupiterX Core < 2.0.7 - Information Disclosure, Modification, and Denial of Service
Fixed in
Fixed in 2.0.7
CVSS
6.3 (medium)