CubeWP Framework — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in CubeWP Framework, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-17018	CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR	-	-	2026-08-10
CVE-2026-17017	CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation	-	-	2026-08-09
CVE-2026-13339	CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CWE-22	7.5	High	2026-08-01
CVE-2026-6453	CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter CWE-89	6.5	Medium	2026-08-01
CVE-2025-6461	CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php CWE-200	4.3	Medium	2026-01-25
CVE-2025-8615	CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode CWE-79	6.4	Medium	2026-01-17
CVE-2025-12129	CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure CWE-200	5.3	Medium	2026-01-17
CVE-2025-4315	CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation CWE-269	8.8	High	2025-06-11

All 8 known CVE vulnerabilities affecting CubeWP Framework with full Chinese analysis, references, and POCs where available.