6.5Medium

CVE-2025-0365Jupiterx Core <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read

artbees Jupiter X Core Published: 2025-02-01 08:30 (1 year ago)

Description

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
artbees	Jupiter X Core	≤ 4.8.7

References and patches

CPE matches (NVD) (1)

cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:wordpress:*:* < 4.8.8

CVSS score

6.5Medium

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

All scores (2)

cna	CVSS 3.1	6.5Medium
security@wordfence.com	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.73%

higher than 55% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-01-09
Published2025-02-01 08:30
Reached IP-DB2026-10-25 00:01
Last updated2026-06-17 11:26

Assigned by (CNA): Wordfence
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

7.1High

CVE-2026-119517 13 hours ago

WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

VillaTheme Catna – Woo Name Your Price and Offers

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price an…

9.3Critical

CVE-2026-124415 13 hours ago

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Alejandro Alex Reservations

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

5.3Medium

CVE-2026-125432 13 hours ago

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

RelyWP reCAPTCHA for WooCommerce

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

8.5High

CVE-2026-124265 13 hours ago

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Tribulant Software Newsletters

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

7.5High

CVE-2026-124267 13 hours ago

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Noor Alam Gmail SMTP

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

7.1High

CVE-2026-124410 13 hours ago

WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translat…