CVE-2026-39491
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability for subscribers in JupiterX Core versions <= 4.14.1.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update to the latest version of JupiterX Core to mitigate this vulnerability.
Other vulnerabilities in JupiterX Core
See all- CVE-2026-39490High
JupiterX Core versions up to 4.14.1 have a vulnerability in access control that allows unauthorized access to resources.
- CVE-2025-58264Medium
The JupiterX Core WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS