Plugin icon

CubeWP Framework

cubewp-framework

Vulnerabilities:

16

Last Updated:

July 29, 2026

Active Installs:

4000

Published
Title
Fixed in
CVSS
Published
2026-08-13
Title
CubeWP < 1.1.31 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.1.31
CVSS
6.5 (medium)
Published
2026-08-05
Title
CubeWP Framework <= 1.1.31 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
Fixed in
No known fix
CVSS
4.9 (medium)
Published
2026-08-04
Title
CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
Fixed in
Fixed in 1.1.31
CVSS
7.7 (high)
Published
2026-08-01
Title
CubeWP Framework < 1.1.31 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Fixed in
Fixed in 1.1.31
CVSS
7.5 (high)
Published
2026-07-31
Title
CubeWP Framework < 1.1.31 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Fixed in
Fixed in 1.1.31
CVSS
6.5 (medium)
Published
2026-01-24
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
Fixed in
Fixed in 1.1.28
CVSS
4.3 (medium)
Published
2026-01-16
Title
CubeWP < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Fixed in
Fixed in 1.1.27
CVSS
6.4 (medium)
Published
2026-01-16
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Information Exposure
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-12-26
Title
CubeWP < 1.1.28 - Missing Authorization
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-09-22
Title
CubeWP < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.27
CVSS
6.4 (medium)
Published
2025-08-19
Title
CubeWP Framework < 1.1.25 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 1.1.25
CVSS
8.8 (high)
Published
2025-06-12
Title
CubeWP Framework < 1.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.24
CVSS
6.4 (medium)
Published
2025-06-10
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.24 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 1.1.24
CVSS
8.8 (high)
Published
2025-06-05
Title
CubeWP <= 1.1.31 - Cross-Site Request Forgery
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2024-10-09
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.16 - Missing Authorization
Fixed in
Fixed in 1.1.16
CVSS
5.4 (medium)
Published
2024-03-28
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.13 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 1.1.13
CVSS
9.9 (critical)