Jupiter X Core CVE-2026-10511

Requires an authenticated account with contributor-level privileges or above (PR:L) on a WordPress site with Jupiter X Core ≤4.61.0 installed, and use of the Raven login form widget whose 'forget_password_link' parameter is stored without proper sanitization/escaping. Exploitation is limited by that privilege requirement (an attacker must already be a trusted, logged-in user, not an anonymous visitor) and by the need for a victim to subsequently load the page containing the injected payload; it is not a zero-interaction remote-unauthenticated flaw despite the AV:N/AC:L vector.

This is a moderate, not emergency, priority. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N): network reachable, low complexity, but requiring contributor-level privileges (PR:L) - so an attacker must already hold an authenticated, trusted account on the target site. The scope change (S:C) reflects that injected script executes in the browser of whoever views the page, with low confidentiality and integrity impact and no availability impact. The multi-source signals are consistent and point to low urgency despite the medium severity: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no SSVC/automatable exploitation signal in the input. The vuln.today decision label is 'this_month,' which aligns with a patch-on-normal-cadence posture rather than act_now/emergency. No public exploit is identified - the references are the Wordfence advisory, WordPress plugin source lines, and the fix changeset, not a weaponized PoC. Net: a real but low-real-world-risk stored XSS whose exploitation is gated behind existing contributor access; prioritize it in routine patching, not as a drop-everything incident.

An attacker who has registered or compromised a contributor-level (or higher) account on a WordPress site running Jupiter X Core edits a page using the Raven login form widget and injects a malicious script into the 'forget_password_link' parameter, which is stored without sufficient sanitization or output escaping. When a site administrator or visitor later loads the page, the script executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public exploit code is identified at time of analysis; exploitation requires an existing authenticated foothold.