Artbees vulnerabilities, page 2
28 vulnerabilities
Known vulnerabilities in Artbees products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
HighCVE-2026-39490artbees · jupiterx core +1 moreWordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.EPSS0.30%MediumCVE-2026-39491artbees · jupiterx core +1 moreWordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerabilitySubscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.EPSS0.23%HighCVE-2026-3533artbees · jupiter x core +1 moreJupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template ImportThe Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configurationEPSS0.69%HighCVE-2023-38385artbees · jupiter x core +2 moreWordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerabilityMissing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.EPSS0.59%CriticalCVE-2023-38389artbees · jupiter x core +2 moreWordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerabilityIncorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.EPSS1.41%CriticalCVE-2023-38388artbees · jupiter x core +2 moreWordPress Jupiter X Core plugin <= 3.3.5 - Unauth. Arbitrary File Upload vulnerabilityUnrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5.EPSS1.70%HighCVE-2023-38394artbees · jupiter x core +2 moreWordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerabilityMissing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.EPSS0.43%HighCVE-2023-32110artbees · jupiterx +1 moreWordPress JupiterX theme <= 3.0.0 - Auth. Local File Inclusion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue affects JupiterX: from n/a through 3.0.0.EPSS0.81%HighCVE-2023-3813artbees · jupiter x core +1 moreJupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File DownloadThe Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.EPSS1.22%