Advisories · Technology
cubewp1211 CubeWP Framework.
Every CVE that names cubewp1211 CubeWP Framework among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
- cubewp1211 CubeWP Framework
- Path traversal
- CVSS 6.5 Medium
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
- cubewp1211 CubeWP Framework
- SQL injection
- CVSS 4.3 Medium
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
- cubewp1211 CubeWP Framework
- Information disclosure
- CVSS 6.4 Medium
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
- cubewp1211 CubeWP Framework
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
- cubewp1211 CubeWP Framework
- Information disclosure
- CVSS 8.8 High
CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
- cubewp1211 CubeWP Framework
- Privilege escalation