Skip to content
Sign in
8.1 High

CVE-2026-17017 The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in…

Description

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.

Affected products and versions

Product Affected versions Fixed in
CubeWP Framework 1.1 earliest → < 1.1.31 1.1.31

Other CVEs of CubeWP Framework

The 2 CVEs of CubeWP Framework →
CVE-2026-17018 The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor… 4.9 Medium
Track this CVE