CVE-2026-119219

Name of the Vulnerable Software and Affected Versions Jupiter X Core versions prior to 4.62.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts via the fields[<custom meta field id>] parameter. These scripts execute when a user accesses an affected page. Successful execution requires the attacker's account to be the post author of a page or post using the Raven Author Box widget, which an administrator can facilitate by reassigning authorship to any user, including new Subscribers.

Recommendations Update Jupiter X Core to version 4.62.1 or later.