CubeWP

Vulnerabilities

• CVE-2025-54735

  WordPress CubeWP Framework Plugin <= 1.1.24 - Privilege Escalation Vulnerability

  High 8.8

• CVE-2025-4315

  CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation

  High 8.8

• CVE-2024-48039

  WordPress CubeWP Framework plugin <= 1.1.15 - Broken Access Control vulnerability

  High 8.8

• CVE-2024-30500

  WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability

  High 8.8

• CVE-2026-28168

  WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

  High 8.5

• CVE-2026-13339

  CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter

  High 7.5

• CVE-2025-68036

  WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability

  High 7.5

• CVE-2026-6453

  CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

  Medium 6.5

• CVE-2025-59569

  WordPress CubeWP Plugin <= 1.1.26 - Cross Site Scripting (XSS) Vulnerability

  Medium 6.5

• CVE-2025-49882

  WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability

  Medium 6.5

• CVE-2025-8615

  CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode

  Medium 6.4

• CVE-2025-12129

  CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure

  Medium 5.3

• CVE-2025-6461

  CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php

  Medium 4.3

• CVE-2025-30994

  WordPress CubeWP plugin <= 1.1.29 - Cross Site Request Forgery (CSRF) vulnerability

  Medium 4.3