Plugin security history

CubeWP Framework Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 13 vulnerability records associated with CubeWP Framework, published between 2024 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

13Total records

1Critical

3High

9Medium

0Low

0Informational

12Patched records

1Currently marked unpatched

2024-03-28First disclosure

2026-08-01Latest disclosure

13 of 13CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2024	2	2 records
2025	6	6 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	1	7.7%
High	3	23.1%
Medium	9	69.2%

Vulnerability-Type Breakdown

Cross-Site Scripting

3 records23.1%

First: 2025. Latest: 2026.

Missing Authorization

2 records15.4%

First: 2024. Latest: 2025.

Privilege Escalation

2 records15.4%

First: 2025. Latest: 2025.

Information Disclosure

2 records15.4%

First: 2026. Latest: 2026.

Arbitrary File Upload

1 record7.7%

First: 2024. Latest: 2024.

CSRF

1 record7.7%

First: 2025. Latest: 2025.

SQL Injection

1 record7.7%

First: 2026. Latest: 2026.

Path Traversal

1 record7.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 12
Currently marked unpatched: 1
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.1.31
1.1.28
1.1.27
1.1.25
1.1.24
1.1.16
1.1.13

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.1.30`	CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter	August 1, 2026	1.1.31	High
`*-1.1.30`	CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter	July 31, 2026	1.1.31	Medium
`*-1.1.27`	CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php	January 24, 2026	1.1.28	Medium
`*-1.1.26`	CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode	January 16, 2026	1.1.27	Medium
`*-1.1.27`	CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure	January 16, 2026	1.1.28	Medium
`*-1.1.27`	CubeWP <= 1.1.27 - Missing Authorization	December 26, 2025	1.1.28	Medium
`*-1.1.26`	CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 22, 2025	1.1.27	Medium
`*-1.1.24`	CubeWP Framework <= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation	August 19, 2025	1.1.25	High
`*-1.1.23`	CubeWP Framework <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 12, 2025	1.1.24	Medium
`*-1.1.23`	CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation	June 10, 2025	1.1.24	High
`*-1.1.24`	CubeWP – All-in-One Dynamic Content Framework <= 1.1.24 - Cross-Site Request Forgery	June 5, 2025	Not supplied	Medium
`*-1.1.15`	CubeWP – All-in-One Dynamic Content Framework <= 1.1.15 - Missing Authorization	October 9, 2024	1.1.16	Medium
`*-1.1.12`	CubeWP – All-in-One Dynamic Content Framework <= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload	March 28, 2024	1.1.13	Critical

Selected source records

Latest Records

HighCVE-2026-13339

CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter

Published: August 1, 2026

Affected versions: *-1.1.30
Patched versions: 1.1.31

Original Wordfence record

MediumCVE-2026-6453

CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

Published: July 31, 2026

Affected versions: *-1.1.30
Patched versions: 1.1.31

Original Wordfence record

MediumCVE-2025-6461

CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php

Published: January 24, 2026

Affected versions: *-1.1.27
Patched versions: 1.1.28

Original Wordfence record

MediumCVE-2025-8615

CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode

Published: January 16, 2026

Affected versions: *-1.1.26
Patched versions: 1.1.27

Original Wordfence record

MediumCVE-2025-12129

CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure

Published: January 16, 2026

Affected versions: *-1.1.27
Patched versions: 1.1.28

Original Wordfence record

MediumCVE-2025-68036

CubeWP <= 1.1.27 - Missing Authorization

Published: December 26, 2025

Affected versions: *-1.1.27
Patched versions: 1.1.28

Original Wordfence record

MediumCVE-2025-59569

CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 22, 2025

Affected versions: *-1.1.26
Patched versions: 1.1.27

Original Wordfence record

HighCVE-2025-54735

CubeWP Framework <= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation

Published: August 19, 2025

Affected versions: *-1.1.24
Patched versions: 1.1.25

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-30500

CubeWP – All-in-One Dynamic Content Framework <= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload

Published: March 28, 2024

Affected versions: *-1.1.12
Patched versions: 1.1.13

Original Wordfence record

HighCVE-2025-4315

CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation

Published: June 10, 2025

Affected versions: *-1.1.23
Patched versions: 1.1.24

Original Wordfence record

HighCVE-2025-54735

CubeWP Framework <= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation

Published: August 19, 2025

Affected versions: *-1.1.24
Patched versions: 1.1.25

Original Wordfence record

HighCVE-2026-13339

CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter

Published: August 1, 2026

Affected versions: *-1.1.30
Patched versions: 1.1.31

Original Wordfence record

MediumCVE-2026-6453

CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

Published: July 31, 2026

Affected versions: *-1.1.30
Patched versions: 1.1.31

Original Wordfence record

MediumCVE-2025-59569

CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 22, 2025

Affected versions: *-1.1.26
Patched versions: 1.1.27

Original Wordfence record

MediumCVE-2025-49882

CubeWP Framework <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 12, 2025

Affected versions: *-1.1.23
Patched versions: 1.1.24

Original Wordfence record

MediumCVE-2025-8615

CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode

Published: January 16, 2026

Affected versions: *-1.1.26
Patched versions: 1.1.27

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-30994

CubeWP – All-in-One Dynamic Content Framework <= 1.1.24 - Cross-Site Request Forgery

Published: June 5, 2025

Affected versions: *-1.1.24
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory