Stored Cross-Site Scripting Vulnerability in CubeWP Plugin by WordPress

CVE-2025-8615

What is CVE-2025-8615?

The CubeWP plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks through its cubewp_shortcode_taxonomy shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes. Attackers with contributor-level access or higher can exploit this issue to inject malicious web scripts into pages, which will subsequently execute in the browsers of users accessing those compromised pages. This risk emphasizes the need for robust security measures and prompt updates to mitigate potential exploitation.

References