This vulnerability allows an attacker to store malicious scripts via the JupiterX Core plugin, resulting in stored cross‑site scripting. When other visitors load the affected page, the injected code runs in their browser, which can lead to session hijacking, credential theft, or defacement. The weakness is a classic input validation failure that compromises integrity and confidentiality for all users of the site.

WordPress installations that use the artbees JupiterX Core plugin 4.8.11 or earlier are affected. The vulnerability is present in all versions from the first release up to and including 4.8.11.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale attacks have been reported. The unlikely yet possible attack path involves exploiting the plugin’s content submission interface, which is likely reachable by administrators or editors with web access, making the attack vector remote through the plugin’s web UI.