An improper neutralization of input during web page generation in the CubeWP plugin for WordPress allows stored cross‑site scripting; attackers could submit malicious scripts that are stored and subsequently executed in the browsers of any site visitor when the affected page is rendered. The assertion that all site visitors are impacted is inferred from the description but not explicitly stated in the advisory.

All WordPress installations that use the CubeWP plugin from Imran Tauqeer with a version number of 1.1.26 or earlier are affected. No newer releases have been reported to contain this flaw.

The vulnerability resides in plugin input fields that lack proper sanitization, allowing an attacker who can submit data to store scripts that are later rendered in the page view. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to inject malicious script via any input endpoint exposed by the plugin, and any authenticated or unauthenticated user capable of submitting content could potentially trigger the stored XSS when normal users view the affected page.