# cve.now: Artbees

The newest entries naming Artbees as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120555](https://cve.now/CVE-2026-120555.md): Jupiter X Core \<= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter (CVSS 5.3)
- [CVE-2026-120737](https://cve.now/CVE-2026-120737.md): Jupiter X Core \<= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive\_query' Parameter (CVSS 5.9)
- [CVE-2026-119219](https://cve.now/CVE-2026-119219.md): Jupiter X Core \<= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta (CVSS 5.4)
- [CVE-2026-106013](https://cve.now/CVE-2026-106013.md): Jupiter X Core \<= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth\_verifier Parameter (CVSS 9.8)
- [CVE-2026-10511](https://cve.now/CVE-2026-10511.md): Jupiter X Core \<= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget\_password\_link' Parameter (CVSS 6.4)
- [CVE-2026-39490](https://cve.now/CVE-2026-39490.md): WordPress JupiterX Core plugin \<= 4.14.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-39491](https://cve.now/CVE-2026-39491.md): WordPress JupiterX Core plugin \<= 4.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-3533](https://cve.now/CVE-2026-3533.md): JupiterX Core \<= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import (CVSS 8.8)
- [CVE-2025-50004](https://cve.now/CVE-2025-50004.md): WordPress JupiterX Core plugin \<= 4.10.1 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-58264](https://cve.now/CVE-2025-58264.md): WordPress JupiterX Core Plugin \<= 4.11.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-3888](https://cve.now/CVE-2025-3888.md): Jupiterx Core \<= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG (CVSS 6.4)
- [CVE-2025-47475](https://cve.now/CVE-2025-47475.md): WordPress JupiterX Core plugin \<= 4.8.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-2105](https://cve.now/CVE-2025-2105.md): Jupiter X Core \<= 4.8.11 - Unauthenticated PHP Object Injection via PHAR (CVSS 8.1)
- [CVE-2025-0365](https://cve.now/CVE-2025-0365.md): Jupiterx Core \<= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5)
- [CVE-2025-0366](https://cve.now/CVE-2025-0366.md): Jupiter X Core \<= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) (CVSS 8.8)
- [CVE-2024-12033](https://cve.now/CVE-2024-12033.md): Jupiter X Core \<= 4.8.5 - Missing Authorization to Authenticated Library Sync (CVSS 4.3)
- [CVE-2024-12316](https://cve.now/CVE-2024-12316.md): Jupiter X Core \<= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export (CVSS 5.3)
- [CVE-2023-38385](https://cve.now/CVE-2023-38385.md): WordPress Jupiter X Core plugin \<= 3.3.0 - Multiple Auth. Broken Access Control vulnerability (CVSS 8.3)
- [CVE-2024-7781](https://cve.now/CVE-2024-7781.md): Jupiter X Core \<= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover (CVSS 8.1)
- [CVE-2024-7772](https://cve.now/CVE-2024-7772.md): Jupiter X Core \<= 4.6.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- [CVE-2023-38389](https://cve.now/CVE-2023-38389.md): WordPress Jupiter X Core plugin \<= 3.3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8)
- [CVE-2023-38394](https://cve.now/CVE-2023-38394.md): WordPress Jupiter X Core plugin \<= 3.3.0 - Multiple Auth. Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-4608](https://cve.now/CVE-2024-4608.md): SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster \<= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4)
- [CVE-2024-30509](https://cve.now/CVE-2024-30509.md): WordPress SellKit plugin \<= 1.8.1 - Arbitrary File Download vulnerability (CVSS 6.5)
- [CVE-2023-32110](https://cve.now/CVE-2023-32110.md): WordPress JupiterX theme \<= 3.0.0 - Auth. Local File Inclusion vulnerability (CVSS 7.6)
- [CVE-2023-38388](https://cve.now/CVE-2023-38388.md): WordPress Jupiter X Core plugin \<= 3.3.5 - Unauth. Arbitrary File Upload vulnerability (CVSS 9.0)
- [CVE-2023-3813](https://cve.now/CVE-2023-3813.md): Jupiter X Core \<= 4.6.6 - Unauthenticated Arbitrary File Download (CVSS 7.5)
- [CVE-2022-1659](https://cve.now/CVE-2022-1659.md): JupiterX Core \<= 2.0.6 - Information Disclosure, Modification, and Denial of Service (CVSS 5.4)
- [CVE-2022-1654](https://cve.now/CVE-2022-1654.md): Jupiter Theme \<= 6.10.1 and JupiterX Core Plugin \<= 2.0.7 - Authenticated Privilege Escalation (CVSS 8.8)
- [CVE-2022-1658](https://cve.now/CVE-2022-1658.md): Jupiter Theme \<= 6.10.1 - Authenticated Arbitrary Plugin Deletion (CVSS 5.4)
- [CVE-2022-1657](https://cve.now/CVE-2022-1657.md): JupiterX Theme \<= 2.0.6 and Jupiter Theme \<= 6.10.1 - Authenticated Path Traversal and Local File Inclusion (CVSS 8.8)
- [CVE-2022-1656](https://cve.now/CVE-2022-1656.md): JupiterX Theme \<= 2.0.6 and JupiterX Core \<= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/artbees
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.