The Cube Portfolio WordPress plugin allows attackers to inject arbitrary SQL statements because it fails to neutralize special characters before using them in a database query. This flaw can enable attackers to read, alter, or delete data stored by the website, potentially exposing sensitive information or compromising the site's integrity. The underlying weakness maps to CWE-89, indicating improper input validation of SQL command elements.

The vulnerability affects the ovatheme Cube Portfolio plugin for all versions n/a through 1.16.8.

The CVSS base score of 8.5 classifies the flaw as high severity, and although the EPSS score is below 1%, we infer that the attack vector is likely through the web interface where the plugin accepts user input. No known static exploit is published and the flaw is not listed in CISA KEV, but the nature of SQL injection means that an attacker with access to the plugin’s configuration or edit pages could exploit the issue if the site does not enforce strict role permissions. The low EPSS does not negate the possibility of use, especially on popular sites with the mentioned vulnerable plugin versions.