Stored Cross-Site Scripting Vulnerability in Jupiter X Core Plugin for WordPress

CVE-2026-119219

What is CVE-2026-119219?

The Jupiter X Core plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to insufficient input validation and output sanitization in the 'fields[<custom_meta_field_id>]' parameter. This vulnerability affects all versions up to and including 4.62.0, allowing unauthenticated attackers to inject malicious scripts into pages that execute when users access an affected page. The exploit requires that the attacker registers an account, which must then be assigned as the post_author of a page that uses the Raven Author Box widget. This widget can be configured by administrators, enabling potential exploitation on newly registered user accounts, including those with minimal permissions.

References