Security Alert Summary
The CubeWP plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the cubewp_shortcode_taxonomy shortcode. Insufficient input sanitization and output escaping of user-supplied attributes allow authenticated users with contributor-level access or higher to inject JavaScript that will execute when a page containing the injected content is viewed.
CVE Details
- CVE ID: CVE-2025-8615
- Affected component: CubeWP plugin for WordPress (shortcode:
cubewp_shortcode_taxonomy) - Affected versions: all versions up to, and including, 1.1.26
- Published: January 17, 2026 at 9:15:51 AM (as listed in the CVE entry)
- Last modified: January 17, 2026 at 9:15:51 AM (as listed in the CVE entry)
- CVSS v3.1: Base Score 6.4, Severity: MEDIUM
- CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authenticated attacker required; privileges required: Low (contributor-level and above); user interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation or Reflection)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue in the cubewp_shortcode_taxonomy shortcode. According to the CVE description, the plugin fails to properly sanitize and escape user-supplied attributes passed to that shortcode. Because input is stored and later rendered in pages, an authenticated user with contributor-level access or higher can supply attributes containing JavaScript payloads that are stored and then executed in the browsers of users who view the affected pages.
No additional functions or REST API endpoints are named in the CVE entry. The root cause as described is insufficient input sanitization and output escaping on user-supplied shortcode attributes, which permits stored script injection.
How This Could Impact Your Website
In a typical small-to-medium WordPress site, multiple people may have different roles: a site owner, internal staff who create content, and external contributors (for example, guest writers or contractors). If a contributor with access to create or edit content uses the vulnerable shortcode with malicious attributes, that content can persist on the site and execute scripts when other users view the page.
- Site owners or editors who view the injected page could have data exposed that is visible in their browser session (consistent with a low confidentiality impact).
- Injected scripts could modify page content visible to users (consistent with a low integrity impact), or be used to craft targeted social engineering or phishing aimed at staff or external collaborators.
- Because availability impact is listed as none, the CVE does not indicate denial-of-service conditions as a primary outcome.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE notes versions up to 1.1.26 are affected).
- Review and reduce unnecessary user roles and privileges, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and content changes for unusual behavior or unexpected shortcode usage.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
