Vulnerabilidades de Artbees
CVEs publicadas que afetam produtos de Artbees: 5 registro(s), com severidade, exploração e correções.
CVE-2026-39490
Alta · 7.5
CWE-862 16/06/2026
WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
CVE-2026-39491
Média · 6.5
CWE-79 15/06/2026
WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
CVE-2026-3533
Alta · 8.8
CWE-434 23/03/2026
JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration
CVE-2025-50004
Alta · 8.8
CWE-502 22/01/2026
WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
CVE-2025-58264
Média · 6.5
CWE-79 22/09/2025
WordPress JupiterX Core Plugin <= 4.11.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.11.0.