WordPress CubeWP plugin <= 1.1.31 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin CubeWP versions = 1.1.31...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28168

CVE-2026-28168 affects the WordPress CubeWP plugin up to version 1.1.30. The issue is described as a Subscriber SQL Injection vulnerability, with CVSS 3.1 base score 8.5 (HIGH ) and a Network attack vector, Low attack complexity, privileges required, no user interaction, and scope Changed with Co...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28168 WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28168 WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

EUVD-2026-57954

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin CubeWP versions = 1.1.30...

WordPress CubeWP Framework plugin <= 1.1.30 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Louis Deschanel JeanJeanLeHaxor, Pascal SUN in WordPress Plugin CubeWP versions = 1.1.30...

PT-2026-71520

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to a lack of per-object read authorization checks and missing restrictions on metadata keys. This allows users with the Contributor role or higher to access arbitr...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

EUVD-2026-55025

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17017

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...