Medium
CVE-2026-28168
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 16
Reset filters
Medium
CVE-2026-17018
CubeWP Framework <= 1.1.30 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure
Medium
CVE-2026-17017
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-13339
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Medium
CVE-2026-6453
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Medium
CVE-2025-6461
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
Medium
CVE-2025-8615
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Medium
CVE-2025-12129
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
Medium
CVE-2025-68036
CubeWP <= 1.1.27 - Missing Authorization
Medium
CVE-2025-59569
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-54735
CubeWP Framework <= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-49882
CubeWP Framework <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-4315
CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-30994
CubeWP – All-in-One Dynamic Content Framework <= 1.1.24 - Cross-Site Request Forgery
Medium
CVE-2024-48039
CubeWP – All-in-One Dynamic Content Framework <= 1.1.15 - Missing Authorization
Critical
CVE-2024-30500
CubeWP – All-in-One Dynamic Content Framework <= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.