Plugin icon

CubeWP Framework

cubewp-framework

Vulnerabilities:

11

Last Updated:

May 6, 2026

Active Installs:

4000

Published
Title
Fixed in
CVSS
Published
2026-01-24
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
Fixed in
Fixed in 1.1.28
CVSS
4.3 (medium)
Published
2026-01-16
Title
CubeWP < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Fixed in
Fixed in 1.1.27
CVSS
6.4 (medium)
Published
2026-01-16
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Information Exposure
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-12-26
Title
CubeWP < 1.1.28 - Missing Authorization
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-09-22
Title
CubeWP < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.27
CVSS
6.4 (medium)
Published
2025-08-19
Title
CubeWP Framework < 1.1.25 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 1.1.25
CVSS
8.8 (high)
Published
2025-06-12
Title
CubeWP Framework < 1.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.24
CVSS
6.4 (medium)
Published
2025-06-10
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.24 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 1.1.24
CVSS
8.8 (high)
Published
2025-06-05
Title
CubeWP <= 1.1.29 - Cross-Site Request Forgery
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2024-10-09
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.16 - Missing Authorization
Fixed in
Fixed in 1.1.16
CVSS
5.4 (medium)
Published
2024-03-28
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.13 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 1.1.13
CVSS
9.9 (critical)