CubeWP Framework · Security record

Is CubeWP Framework safe?

2 known vulnerabilities affect the current version (1.1.31), and they have no fix yet.

Checked 4 days ago against the WPVulnerability database, for version 1.1.31.

How it’s looked after

Last release: Jul 29, 2026 (3 months ago)
Releases in the last year: 4
Tested up to: WordPress 7.0.8
Support resolved: 0 of 1 threads in two months
Active installs: 3K+

16 known vulnerabilities

6 high
8 medium
2 not rated

2 affect the current version. 2 have no fix yet.

Disclosed each year

20242
20256
20268

Every known vulnerability in CubeWP Framework

Newest first, with any that affect the current version at the top.

Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure
Affects the current version · No fix yet · CVE-2026-17018 · Aug 10, 2026 · Wordfence
medium
Cross-Site Request Forgery
Affects the current version · No fix yet · CVE-2025-30994 · Jun 5, 2025 · Wordfence
high
Authenticated (Subscriber+) SQL Injection
Fixed in 1.1.31 · CVE-2026-28168 · Aug 13, 2026 · Wordfence
SQL Injection
Fixed in 1.1.31 · CVE-2026-17017 · Aug 9, 2026 · CVE
high
Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Fixed in 1.1.31 · CVE-2026-13339 · Aug 1, 2026 · Wordfence
medium
Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Fixed in 1.1.31 · CVE-2026-6453 · Jul 31, 2026 · Wordfence
medium
Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
Fixed in 1.1.28 · CVE-2025-6461 · Jan 24, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Fixed in 1.1.27 · CVE-2025-8615 · Jan 16, 2026 · Wordfence
medium
Unauthenticated Information Exposure
Fixed in 1.1.28 · CVE-2025-12129 · Jan 16, 2026 · Wordfence
high
Missing Authorization
Fixed in 1.1.28 · CVE-2025-68036 · Dec 26, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 1.1.27 · CVE-2025-59569 · Sep 22, 2025 · Wordfence
high
Authenticated (Subscriber+) Privilege Escalation
Fixed in 1.1.25 · CVE-2025-54735 · Aug 19, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 1.1.24 · CVE-2025-49882 · Jun 12, 2025 · Wordfence
high
Authenticated (Subscriber+) Privilege Escalation
Fixed in 1.1.24 · CVE-2025-4315 · Jun 10, 2025 · Wordfence
medium
Missing Authorization
Fixed in 1.1.16 · CVE-2024-48039 · Oct 9, 2024 · Wordfence
high
Authenticated (Subscriber+) Arbitrary File Upload
Fixed in 1.1.13 · CVE-2024-30500 · Mar 28, 2024 · Wordfence

Questions about CubeWP Framework’s security

Is CubeWP Framework safe to use?

Yes: 2 known vulnerabilities affect version 1.1.31, according to WPVulnerability’s database. Until a fixed version is out, weigh the risk, or switch to an alternative.

Does CubeWP Framework have known security vulnerabilities?

Yes: 2 known vulnerabilities affect version 1.1.31, according to WPVulnerability’s database.

Is CubeWP Framework still maintained?

Yes. Its last release was 3 months ago. Its authors resolved 0 of the 1 support threads opened in the last two months.

Is CubeWP Framework compatible with the latest WordPress?

It’s tested up to WordPress 7.0.8, one version behind the current 7.1. Authors often update this line a few weeks after a release.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.