CVE-2026-10511

Name of the Vulnerable Software and Affected Versions Jupiter X Core versions prior to 4.61.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the forget password link parameter. These scripts execute whenever a user accesses the affected page.

Recommendations Update Jupiter X Core to version 4.61.1 or later. As a temporary mitigation, restrict access to the forget password link parameter for users with contributor-level permissions.