CubeWP Framework vulnerabilities

2 known vulnerabilities in CubeWP Framework from Cubewp1211. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  CubeWP Framework: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-13339Aug 2, 2026Cubewp1211

  The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files

• 8.8 High severity

  CubeWP Framework: Improper Privilege Management

  CVE-2025-4315Jun 11, 2025Cubewp1211

  The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the update_user_meta() fu