Artbees' vulnerability footprint centers on a narrow line of WordPress themes and plugins, notably Jupiter X Core, JupiterX, Jupiter, and Sellkit, that serve website builders and e-commerce functionality across a sizable installed base. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and recur consistently through access-control and input-handling weaknesses—path traversal, missing authorization, improper access control, and cross-site scripting—that are characteristic of web-application middleware. The exposure pattern reflects the vendor's role in the WordPress ecosystem, where plugin vulnerabilities can affect many downstream sites and represent a high-value target for automated exploitation. Defenders should prioritize tracking updates to these plugins and treat unauthorized-access and injection flaws in this vendor's products as requiring prompt remediation; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Artbees over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-38389CRITICAL Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3. | Jun 21, 2024 | 9.8 | 32 | NO | NO |
CVE-2026-3533HIGH The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type va | Mar 24, 2026 | 8.8 | 30 | NO | NO |
CVE-2024-7772CRITICAL The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and inclu | Sep 26, 2024 | 9.8 | 29 | NO | NO |
CVE-2024-7781CRITICAL The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Lo | Sep 26, 2024 | 9.8 | 28 | NO | NO |
CVE-2025-0366HIGH The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_svg() function. This | Feb 1, 2025 | 8.8 | 27 | NO | NO |
CVE-2023-38385HIGH Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 th | Dec 13, 2024 | 8.8 | 26 | NO | NO |
CVE-2025-2105HIGH The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' pa | Apr 26, 2025 | 8.1 | 25 | NO | NO |
CVE-2023-32110HIGH Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue affects JupiterX: from n | May 17, 2024 | 8.8 | 24 | NO | NO |
CVE-2023-38388CRITICAL Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5. | Mar 26, 2024 | 9.8 | 24 | NO | NO |
CVE-2022-1659HIGH Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/cla | Jun 13, 2022 | 7.3 | 24 | NO | NO |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Artbees.
Media articles that mention a CVE ID that affects a product developed by Artbees — matched by CVE ID, not by vendor name.