Stored Cross-Site Scripting Vulnerability in CubeWP Plugin by WordPress

CVE-2025-8615

What is CVE-2025-8615?

The CubeWP plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks through its cubewp_shortcode_taxonomy shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes. Attackers with contributor-level access or higher can exploit this issue to inject malicious web scripts into pages, which will subsequently execute in the browsers of users accessing those compromised pages. This risk emphasizes the need for robust security measures and prompt updates to mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References