Stored Cross-Site Scripting in Jupiter X Core Plugin for WordPress

CVE-2025-3888

What is CVE-2025-3888?

The Jupiter X Core plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the inadequate handling of SVG file inclusions. This issue arises from a lack of proper input sanitization and output escaping, enabling authenticated users with Contributor-level access or higher to inject malicious scripts. When other users visit the affected pages containing the compromised SVG file, these scripts are executed, potentially leading to harmful consequences.

References