Jupiter X Core

Jupiter X Core has 23 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 23 are fixed as of September 2026. Their average CVSS score is 7.3, and the most serious one scores 9.9 out of 10. Severity breakdown: 4 critical and 8 high. 2025 was the busiest year with 8 disclosures.

The most common weakness is Missing Authorization, behind 6 of the records (26%). Other recurring categories include Cross-Site Scripting, Unrestricted Upload Of File With Dangerous Type.

Every one of the 23 issues recorded for Jupiter X Core has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (4) reported by Rafie Muhammad. Jupiter X Core is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh

7.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Jupiter X Core vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.9CVE-2022-1654

Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation

Read the full analysis

Vulnerability Records

23 records


2026-04-20 00:00	Jupiter X Core <= 4.14.1 - Missing Authorization Jupiter X Core <= 4.14.1	`CVE-2026-39490`	5.3 Medium	hivesec	Yes
2026-04-13 00:00	Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Jupiter X Core <= 4.14.1	`CVE-2026-39491`	6.4 Medium	Nguyen Ba Khanh	Yes
2026-03-23 10:26	JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import Jupiter X Core <= 4.14.1	`CVE-2026-3533`	8.8 High	AlexHenry	Yes
2026-01-12 00:00	JupiterX Core <= 4.10.1 - Authenticated (Contributor+) PHP Object Injection Jupiter X Core <= 4.10.1	`CVE-2025-50004`	7.5 High	João Pedro Soares de Alcântara	Yes
2025-09-22 00:00	JupiterX Core <= 4.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Jupiter X Core <= 4.11.0	`CVE-2025-58264`	6.4 Medium	Michael	Yes
2025-05-16 00:00	Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG Jupiter X Core <= 4.8.12	`CVE-2025-3888`	6.4 Medium	stealthcopter	Yes
2025-05-07 00:00	JupiterX Core <= 4.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting Jupiter X Core <= 4.8.11	`CVE-2025-47475`	6.4 Medium	Michael	Yes
2025-04-25 17:04	Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR Jupiter X Core <= 4.8.11	`CVE-2025-2105`	8.1 High	Phat RiO	Yes
2025-01-31 00:00	Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) Jupiter X Core <= 4.8.7	`CVE-2025-0366`	8.8 High	stealthcopter	Yes
2025-01-31 00:00	Jupiterx Core <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read Jupiter X Core <= 4.8.7	`CVE-2025-0365`	6.5 Medium	stealthcopter	Yes

Showing 1–10 of 23 reports

Plugin Profile

Latestv4.60.0

Jupiter X Core

Author

artbees

1.9(9)

38/100

Last Updated

2026-08-17 (27d ago)

Active Installs

70,000+

Downloads

878,581

Requires WP

5.6+

Requires PHP

7.0+

Tested up to

WP 6.9.7

Created

2019-08-27 (7y ago)

Jupiter X Core plugin provides the necessary core functionality for Jupiter X theme. All Jupiter X users need to install and activate this plugin to use the full feature of the theme. Advanced Control Panel to handle template and plugin installation, manage settings, and more. Advanced Customizer to customize different parts of the website. Header, footer, single, archive builders. New Elementor widgets. New Elementor Dynamic tags. and more. It’s worth mentioning that, some of the features are disabled for the Jupiter X Lite theme.

View on WordPress.org