CVE-2025-3888: Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3888?
CVE-2025-3888 has a high severity due to its potential for exploitation via stored cross-site scripting.
How do I fix CVE-2025-3888?
To fix CVE-2025-3888, update the Jupiter X Core plugin to a version later than 4.8.12 that addresses this vulnerability.
What type of vulnerability is CVE-2025-3888?
CVE-2025-3888 is classified as a Stored Cross-Site Scripting vulnerability.
Who is affected by CVE-2025-3888?
CVE-2025-3888 affects users of the Jupiter X Core plugin for WordPress versions up to and including 4.8.12.
What are the implications of CVE-2025-3888?
The implications of CVE-2025-3888 include potential unauthorized access and data manipulation by authenticated attackers.