The Jupiter X Core plugin for WordPress suffers from a CWE-434 vulnerability involving unrestricted upload of files with dangerous types. The import_popup_templates() function lacks proper authorization checks, and the upload_files() function does not sufficiently validate file types. Authenticated attackers with at least Subscriber privileges can exploit this to upload malicious files. On servers configured to treat .phar files as executable PHP, this can lead to remote code execution. Additionally, uploading files such as .svg, .dfxp, or .xhtml can result in stored cross-site scripting attacks regardless of server configuration. This vulnerability affects all versions up to and including 4.14.1.

Successful exploitation can lead to remote code execution on vulnerable server configurations, allowing attackers to execute arbitrary code with the privileges of the web server. Alternatively, it can enable stored cross-site scripting attacks, potentially compromising site visitors and administrators. The vulnerability requires authenticated access at Subscriber level or higher, which lowers the attack barrier compared to administrator-only flaws. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that can upload files, and consider disabling or limiting the plugin's file upload features. Monitor for updates from the vendor and apply patches promptly once released. Avoid server configurations that treat .phar files as executable PHP if possible.