← WordPress Vulnerabilities
WordPress security by component

Javo Core

Javo Core is a WordPress component with 5 published CVE records in this archive. The latest tracked vulnerability was published Dec 18, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: javo-core

CVE-2025-60068: Javo Core: Code execution

Javo Core is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

PublishedDec 18, 2025
Safe version guidanceSee mitigation notes
Safe version
Dec 18, 2025 CVE-2025-60068
Javo Core: Code execution
Javo Core is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE6.5
NVDPending
Dec 18, 2025 CVE-2025-58877
Javo Core: A security weakness
Javo Core is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE7.5
NVDPending
Sep 26, 2025 CVE-2025-60111
Javo Core: Privilege escalation or authentication bypass
Javo Core is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
See mitigation notes
CVE8.8
NVDPending
Sep 22, 2025 CVE-2025-58003
Javo Core: A security weakness
Javo Core is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Mar 08, 2025 CVE-2025-0177
Javo Core: Privilege escalation or authentication bypass
Javo Core is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
See mitigation notes
CVE9.8
NVD9.8