Stored Cross-Site Scripting Vulnerability in Jupiter X Core Plugin for WordPress

CVE-2026-10511

What is CVE-2026-10511?

The Jupiter X Core plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack through the 'forget_password_link' parameter. This vulnerability stems from inadequate input sanitization and output escaping across all versions up to and including 4.61.0. Authenticated attackers with contributor-level access and higher can exploit this flaw to inject arbitrary web scripts into pages, which will execute whenever users access the compromised pages, potentially leading to a range of malicious outcomes.

References