Cross-Site Scripting Vulnerability in CubeWP by Emraan Cheema
CVE-2025-59569

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
CubeWP
Vendor
CVE Published:
22 September 2025

What is CVE-2025-59569?

The CubeWP plugin by Emraan Cheema contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. This flaw can lead to stored XSS attacks, where the injected scripts are saved and executed in the context of the user's session, potentially compromising user data and application integrity. Affected versions include all from n/a to 1.1.26, emphasizing the need for immediate updates to mitigate risks associated with improper input handling during web page generation.

Affected Version(s)

CubeWP <= 1.1.26

References

https://patchstack.com/database/wordpress/plugin/cubewp-f...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zaim (Patchstack Alliance)
.
CVE-2025-59569 : Cross-Site Scripting Vulnerability in CubeWP by Emraan Cheema