CVE-2025-3888: Jupiter X Core XSS Vulnerability

CVE-2025-3888 Overview

The Jupiter X Core plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability via SVG file inclusion. The flaw affects all versions up to and including 4.8.12. It stems from insufficient input sanitization and output escaping in the inline SVG widget shipped with the Raven module.

Authenticated users with Contributor-level access or higher can inject arbitrary web scripts into pages. Those scripts execute whenever another user views the page containing the malicious SVG. The vulnerability is tracked as [CWE-79] and was assigned by Wordfence.

Critical Impact
Authenticated contributors can inject JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, forced administrative actions, and content defacement.

Affected Products

Artbees Jupiter X Core plugin for WordPress, all versions through 4.8.12
WordPress sites using the Raven module's inline-svg widget
Any site allowing Contributor-level accounts to publish content with the plugin enabled

Discovery Timeline

2025-05-17 - CVE-2025-3888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3888

Vulnerability Analysis

The Jupiter X Core plugin ships an inline-svg widget under the Raven extension. The widget accepts SVG markup and renders it directly into page output. The rendering path does not strip active content such as <script> elements or event handler attributes from the supplied SVG.

Because SVG is XML that supports embedded JavaScript, an attacker who controls the SVG payload controls script execution in the victim's browser. The stored nature of the flaw means the payload persists in the page and fires for every visitor. The affected code path is documented in the plugin source at line 304 of inline-svg.php.

Execution occurs in the origin of the WordPress site. A payload triggered in an administrator session inherits that administrator's privileges within the browser, including access to nonces and REST endpoints.

Root Cause

The root cause is missing sanitization and output escaping on user-supplied SVG content. The widget treats the SVG as trusted markup and echoes it into the DOM. WordPress does not sanitize SVG uploads by default, so the plugin is responsible for filtering script-bearing nodes before rendering.

Attack Vector

An authenticated Contributor uploads or references an SVG file containing JavaScript inside a <script> tag or an attribute such as onload. The attacker inserts the inline SVG widget into a post or page. When a reviewer, editor, or administrator opens the page in the WordPress preview or on the front end, the embedded JavaScript executes with the viewer's session context.

The vulnerability manifests through the plugin's inline-svg widget rendering routine. See the Wordfence Vulnerability Analysis for the technical writeup and the WordPress Plugin Changeset Update for the fixed code.

Detection Methods for CVE-2025-3888

Indicators of Compromise

SVG files uploaded to wp-content/uploads/ containing <script> tags, onload=, onclick=, or javascript: URI attributes
Post or page content referencing the Raven inline-svg widget with unexpected SVG payloads authored by low-privilege accounts
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin-rendered pages

Detection Strategies

Scan the WordPress media library and post_content in the database for SVG markup containing scripting constructs
Audit the wp_posts table for inline-svg shortcodes or Elementor widget blocks authored by Contributor-role users
Review web server access logs for GET requests to SVG assets followed by requests to /wp-admin/ endpoints from the same session

Monitoring Recommendations

Alert on new Contributor or Author accounts followed by rapid content creation using SVG media
Monitor plugin file integrity and flag any modification to inline-svg.php outside of official update windows
Track browser console errors and Content Security Policy violations reported from /wp-admin/ pages

How to Mitigate CVE-2025-3888

Immediate Actions Required

Update Jupiter X Core to a version later than 4.8.12 that includes the fix from changeset 3292376
Audit all Contributor, Author, and Editor accounts and remove those that are inactive or unrecognized
Review recent posts and media uploads for malicious SVG payloads and purge them from the database and filesystem

Patch Information

Artbees addressed the flaw in the plugin update tracked by WordPress Plugin Changeset 3292376. The fix adds sanitization to the inline SVG rendering path in the Raven module. Site administrators should upgrade through the WordPress plugin management console or via WP-CLI.

Workarounds

Restrict SVG uploads by removing image/svg+xml from allowed MIME types until the plugin is patched
Deploy a Content Security Policy that blocks inline scripts on published pages to limit XSS execution
Temporarily disable the Raven inline-svg widget or restrict content creation to trusted Editor and Administrator accounts

bash

# Update Jupiter X Core via WP-CLI
wp plugin update jupiterx-core
wp plugin get jupiterx-core --field=version

# Remove SVG from allowed uploads (add to functions.php or a mu-plugin)
# add_filter('upload_mimes', function($m){ unset($m['svg']); return $m; });