163 matches found
CVE-2025-49880 WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through = 1.1.5...
CVE-2025-49880
Summary: CVE-2025-49880 affects WordPress CubeWP Forms (versions up to 1.1.5) with a missing authorization flaw enabling attackers to exploit misconfigured access controls. The vulnerability originates from inadequate access control checks in CubeWP Forms and is cataloged with a CVSS v3.1 base sc...
CVE-2025-49882 WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XSS.This issue affects CubeWP: from n/a through = 1.1.23...
CVE-2025-49882
CVE-2025-49882 is a cross-site scripting vulnerability in the WordPress CubeWP Framework, identified as a DOM-based XSS due to improper input neutralization in web page generation. Affected software is CubeWP Framework versions up to and including 1.1.23. Public sources corroborate the issue with...
CVE-2025-49882 WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XSS.This issue affects CubeWP: from n/a through = 1.1.23...
WordPress plugin CubeWP Forms 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An authorization issue vulnerability exists in the WordPress CubeWP Forms plugin that stems from a lack of authorization and can be exploited by an attacker to configure incorre...
PT-2025-25734 · Unknown · Cubewp Forms
Name of the Vulnerable Software and Affected Versions: CubeWP Forms versions 1.1.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For CubeWP Forms versions 1.1....
WordPress plugin CubeWP Framework 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2025-25736 · Unknown · Cubewp Framework
Name of the Vulnerable Software and Affected Versions: CubeWP Framework versions 1.1.23 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS in the CubeWP Framework...
CVE-2025-4315
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...
WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin CubeWP versions = 1.1.23...
WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Mika in WordPress Plugin CubeWP Forms versions = 1.1.5...
CVE-2025-4315
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...
CVE-2025-4315
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...
CVE-2025-4315 CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...
CVE-2025-4315 CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...
CVE-2025-4315
Summary: CVE-2025-4315 affects the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress. The vulnerability is an authenticated privilege-escalation flaw exploitable by users with Subscriber+ privileges to elevate to Administrator via improper handling of update_user_meta(), affectin...
WordPress plugin CubeWP 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2025-25201 · WordPress · Cubewp
Name of the Vulnerable Software and Affected Versions: The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress version 1.1.23 and earlier Description: The issue is related to Privilege Escalation, allowing authenticated attackers with Subscriber-level access and above to elevate...