THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-6453 (MEDIUM 6.5) — The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter bef

[NVD] CVE-2026-6453 (MEDIUM 6.5) — The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter bef

mednvdPublished 2026-08-01

CVE-2026-6453 CVSS: 6.5 MEDIUM Published: 2026-08-01T09:17:02.530

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query wi

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-6453