The Jupiter X Core plugin accepts a custom meta field through the 'fields[<custom_meta_field_id>]' parameter and stores it without proper sanitization or escaping. Unauthenticated users can register an account, supply malicious content to this field, and the input is later rendered inside the Raven Author Box widget attached to a page or post. The stored script runs in the context of any visitor who loads the affected page, allowing attackers to deface content, steal credentials, or perform further malicious actions.

The vulnerability exists in all versions of the Artbees Jupiter X Core plugin up to and including 4.62.0. Any WordPress site that has installed one of these versions and uses the Raven Author Box widget is affected. The specific product name is Jupiter X Core.

The CVSS score of 5.4 classifies the flaw as moderate; the EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack path requires an attacker to first register a user account (which can be done anonymously) and then be assigned as the author of a post or page that includes the Raven Author Box. Once this is achieved, the injected script is stored and will execute on every page view. Because the attacker can create content visible to all logged‑in users, the potential impact covers confidentiality and integrity of site data and could lead to session hijacking or credential theft. The absence of immediate exploitation data suggests the risk is moderate, but the ability to execute arbitrary JavaScript makes prompt remediation advisable.