CVE-2025-59569

MediumCVSS 6.5

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The CubeWP plugin up to version 1.1.26 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.

Risk Assessment

Attackers can inject malicious scripts, potentially leading to data theft, session hijacking, or malware distribution.

Recommendation

Update the CubeWP plugin to the latest patched version. Restrict user permissions and regularly scan content for malicious code.

Other vulnerabilities in CubeWP

CVE-2026-28168High
CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Stored XSS.This issue affects CubeWP: from n/a through <= 1.1.26.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS