WordPress Plugin Vulnerabilities

CubeWP <= 1.1.31 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update plugin settings granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
cubewp-framework
No known fix

References

CVE
CVE-2025-30994
URL
https://patchstack.com/database/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-all-in-one-dynamic-content-framework-plugin-1-1-23-cross-site-request-forgery-csrf-to-settings-change-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
domiee13
Verified
No
WPVDB ID
df80bbc0-6f2f-4740-8bcc-e8161b50d5df

Timeline

Publicly Published
2025-06-05 (about 1 year ago)
Added
2025-06-11 (about 1 year ago)
Last Updated
2026-08-28 (about 1 month ago)

Other

Published
Title
Published
2023-08-11
Title
WP HTML Mail < 3.4.2 - Test Email Sending via CSRF
Published
2024-11-15
Title
404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function
Published
2024-01-23
Title
Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF
Published
2022-07-08
Title
Counter Box < 1.2.1 - Arbitrary Counter Activation/Deactivation via CSRF
Published
2024-01-31
Title
Accessibility < 1.0.7 - Cross-Site Request Forgery