Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Aug 13, 2026Subscriber SQL Injection in CubeWP <= 1.1.30 versions.CVE-2026-28168 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026CubeWP Framework: Does not perform a per-object read authorization checkCVE-2026-17018 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 9, 2026CubeWP Framework: Does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX actionCVE-2026-17017 · WordPress plugins & themes · reported by WPScanHigh 8.1
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.
- Product
- CubeWP Framework
- Fixed in
- 1.1.31
- What to do
- Update CubeWP Framework to 1.1.31 or newer.
Aug 1, 2026CubeWP Framework: Directory TraversalCVE-2026-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026CubeWP Framework: SQL InjectionCVE-2026-6453 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026ionCube tester plus: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69411 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through <= 1.3.
- Product
- ionCube tester plus
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ionCube tester plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2026CubeWP – All-in-One Dynamic Content Framework: Information ExposureCVE-2025-6461 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- CubeWP – All-in-One Dynamic Content Framework
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update CubeWP – All-in-One Dynamic Content Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 17, 2026CubeWP: Stored Cross-Site ScriptingCVE-2025-8615 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and including, 1.1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CubeWP
- Affected
- up to 1.1.26
- What to do
- Affects up to 1.1.26. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 17, 2026CubeWP – All-in-One Dynamic Content Framework: Information ExposureCVE-2025-12129 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- CubeWP – All-in-One Dynamic Content Framework
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update CubeWP – All-in-One Dynamic Content Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 29, 2025CubeWP: Missing AuthorizationCVE-2025-68036 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CubeWP: from n/a through <= 1.1.27.
- Product
- CubeWP
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025MaxCube: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60053 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MaxCube maxcube allows PHP Local File Inclusion.This issue affects MaxCube: from n/a through <= 1.3.1.
- Product
- MaxCube
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update MaxCube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CubeWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Stored XSS.This issue affects CubeWP: from n/a through <= 1.1.26.
- Product
- CubeWP
- Affected
- up to 1.1.26
- What to do
- Affects up to 1.1.26. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025CubeWP: Incorrect Privilege AssignmentCVE-2025-54735 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <= 1.1.24.
- Product
- CubeWP
- Affected
- up to 1.1.24
- What to do
- Affects up to 1.1.24. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Cube Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52823 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.
- Product
- Cube Portfolio
- Affected
- up to 1.16.8
- What to do
- Affects up to 1.16.8. Update Cube Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025CubeWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49882 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XSS.This issue affects CubeWP: from n/a through <= 1.1.23.
- Product
- CubeWP
- Affected
- up to 1.1.23
- What to do
- Affects up to 1.1.23. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025CubeWP Forms: Missing AuthorizationCVE-2025-49880 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.5.
- Product
- CubeWP Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2025CubeWP – All-in-One Dynamic Content Framework: Privilege EscalationCVE-2025-4315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
- Product
- CubeWP – All-in-One Dynamic Content Framework
- Affected
- up to 1.1.23
- What to do
- Affects up to 1.1.23. Update CubeWP – All-in-One Dynamic Content Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025CubeWP: Cross-Site Request Forgery (CSRF)CVE-2025-30994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Cross Site Request Forgery.This issue affects CubeWP: from n/a through <= 1.1.29.
- Product
- CubeWP
- Affected
- up to 1.1.29
- What to do
- Affects up to 1.1.29. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025CubePoints: Cross-Site Request Forgery (CSRF)CVE-2025-28952 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through <= 3.2.1.
- Product
- CubePoints
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update CubePoints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025CubePM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Lau CubePM cubepm allows Reflected XSS.This issue affects CubePM: from n/a through <= 1.0.
- Product
- CubePM
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CubePM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025CubeWP Forms: Missing AuthorizationCVE-2024-51651 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.10.
- Product
- CubeWP Forms
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024CubeWP: Missing AuthorizationCVE-2024-48039 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP: from n/a through <= 1.1.15.
- Product
- CubeWP
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024CubeWP Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47300 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Stored XSS.This issue affects CubeWP Forms: from n/a through <= 1.1.1.
- Product
- CubeWP Forms
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 29, 2024CubeWP – All-in-One Dynamic Content Framework: Unrestricted Upload of File with Dangerous TypeCVE-2024-30500 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.
- Product
- CubeWP – All-in-One Dynamic Content Framework
- Affected
- up to 1.1.12
- What to do
- Affects up to 1.1.12. Update CubeWP – All-in-One Dynamic Content Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2022Cube Slider: Does not sanitise and escape the idslider parameter before using it in various SQL queriesCVE-2022-1684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
- Product
- Cube Slider
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Cube Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2020Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTMCVE-2014-4553 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
- Product
- spreadshirt-rss-3d-cube-flash-gallery
- Affected
- 2014 to 2014
- What to do
- Affects 2014 to 2014. Update spreadshirt-rss-3d-cube-flash-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.