JupiterX Core plugin versions up to 4.14.1 contain a Subscriber Cross Site Scripting flaw. The vulnerability permits the injection of malicious scripts into subscriber‑related content, potentially causing unintended JavaScript execution in browsers that view that data. Unlike a purely reflected XSS, the attack likely targets data stored or displayed to site users, which could lead to cookie theft, session hijacking, or defacement of the site. Based on the description, the attacker may need access to the WordPress administration interface to inject the payload, although the exact exploitation path is not detailed in the data and is therefore inferred.

WordPress sites that have the Artbees JupiterX Core plugin installed, particularly those on or below version 4.14.1. This includes any WordPress deployment that uses the plugin to manage or display subscriber information.

The CVSS score of 6.5 classifies the flaw as having moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, which suggests it is not a widely exploited or prioritized threat. Nonetheless, because the flaw involves client‑side script execution, it can give an attacker a foothold in the browsers of site visitors or administrators if the plugin allows arbitrary input. The risk is mitigated primarily by applying the vendor’s fix, but the moderate score underlines the importance of addressing it without delay.