CVE-2026-28168

HighCVSS 8.5

Published: 13/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.

Risk Assessment

The risk includes unauthorized access to the database, potentially leading to data leakage or modification.

Recommendation

Update the CubeWP plugin to a version newer than 1.1.30 that includes a fix for the SQL Injection vulnerability.

Other vulnerabilities in CubeWP

CVE-2025-59569Medium
The CubeWP plugin up to version 1.1.26 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.

Original NVD description (English source)

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS