CVE-2026-10511: 
WordPress vulnerability analysis and mitigation

CVE-2026-10511 is a Stored Cross-Site Scripting (XSS) vulnerability in the Jupiter X Core plugin for WordPress, affecting all versions up to and including 4.61.0. The flaw exists in the forget_password_link parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. It was published on October 27, 2026, with Wordfence as the assigning authority. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), stemming from the plugin's failure to properly sanitize user-supplied input for the forget_password_link parameter and escape it on output. The vulnerability resides in the login widget of the Raven Forms module within the Jupiter X Core plugin, specifically in includes/extensions/raven/includes/modules/forms/widgets/login.php. An authenticated attacker with at least contributor-level privileges can supply a malicious script payload via this parameter, which is then stored in the database and rendered unsanitized to any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the browsers of all users who visit the compromised page, impacting both confidentiality and integrity. Attackers could steal session cookies, redirect users to phishing sites, perform actions on behalf of victims (including administrators), or deface site content. While availability is not directly impacted, a compromised administrator session could lead to full site takeover (Wordfence).

As of the publication date, no public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which somewhat limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise an account on the target WordPress site with at least contributor-level privileges.
2. Locate Vulnerable Widget: Navigate to a page or post using the Jupiter X Core Raven login form widget that exposes the forget_password_link parameter.
3. Inject Malicious Payload: Edit the widget or submit a crafted request setting the forget_password_link parameter to a malicious JavaScript payload, e.g., javascript:/*--></title></style></textarea></script><script>alert(document.cookie)</script>.
4. Persist the Payload: Save or publish the page/post, causing the unsanitized payload to be stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further exploitation (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to pages containing the Jupiter X Core login widget with unusual or encoded values in the forget_password_link parameter.
• Database: Unexpected JavaScript or HTML script tags stored in the WordPress wp_postmeta or wp_options tables associated with Jupiter X Core login widget settings.
• File System: Review of login.php in jupiterx-core/includes/extensions/raven/includes/modules/forms/widgets/ for unauthorized modifications.
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages with the Jupiter X Core login widget, potentially indicating script-based data exfiltration.

Site administrators should update the Jupiter X Core plugin to version 4.61.1 or later, which contains the fix for this vulnerability as reflected in the plugin changeset (WordPress Trac). As a temporary workaround, restrict contributor-level user registration or limit access to pages using the affected login widget until the patch is applied. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts (Wordfence).