Analysis Report Folder Analysis cache/cubewp-framework_1.1.27 → cache/cubewp-framework_1.1.28 - CVE-2025-12129

--- cache/cubewp-framework_1.1.27/cube.php	2026-01-18 00:20:47.545240264 +0000+++ cache/cubewp-framework_1.1.28/cube.php	2026-01-18 00:20:56.217779093 +0000@@ -3,14 +3,15 @@ * Plugin Name: CubeWP Framework * Plugin URI: https://cubewp.com/ * Description: CubeWP is an end-to-end dynamic content framework for WordPress to help you save up to 90% of your coding time.-* Version: 1.1.27+* Version: 1.1.28 * Author: CubeWP * Author URI: https://cubewp.com * Text Domain: cubewp-framework * Domain Path: /languages/+* License: GPLv2 or later * @package Cubewp * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */-+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals // Exit if accessed directly. if ( !defined( 'ABSPATH' ) ) exit;

I'll analyze this code diff for security vulnerabilities.

**Vulnerability Existed: no**

**No Security Vulnerabilities Detected**

**Explanation:**

This diff contains only non-functional changes to the `cube.php` file header:

1. **Version bump** (1.1.27 → 1.1.28): Standard version update with no security implications.

2. **License header addition** (`License: GPLv2 or later`): Metadata addition with no security impact.

3. **phpcs directive addition** (`// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals`): This is a code style linter directive that temporarily disables a WordPress coding standard check. While this could theoretically mask naming convention violations, the directive itself doesn't introduce or fix a vulnerability—it's purely a linting control. The actual security posture depends on what violations exist in the code below this comment, which are not shown in the diff.

4. **Whitespace changes**: Removal of blank line is cosmetic only.

None of these changes introduce security vulnerabilities, nor do they fix existing ones. This appears to be a routine maintenance release with version updates and documentation improvements.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-add-ons.php	2026-01-18 00:20:47.465235293 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-add-ons.php	2026-01-18 00:20:56.197777850 +0000@@ -55,23 +55,28 @@ 		$wp_version = $GLOBALS['wp_version'];  		if (version_compare($wp_version, '5.8', '<'))-			$message[] = __('This CubeWP Add-on requires WordPress 4.0 or higher. Version detected:', 'cubewp-frontend') . ' ' . $wp_version;+			$message[] = __('This CubeWP Add-on requires WordPress 4.0 or higher. Version detected:', 'cubewp-framework') . ' ' . $wp_version;  		// PHP check 		$php_version = phpversion(); 		if (version_compare($php_version, '5.3', '<'))-			$message[] = __('This CubeWP Add-on requires PHP 5.3 or higher. Version detected: ', 'cubewp-frontend') . ' ' . $php_version;+			$message[] = __('This CubeWP Add-on requires PHP 5.3 or higher. Version detected: ', 'cubewp-framework') . ' ' . $php_version;  		// SQL check 		$sql_version = $wpdb->db_version(); 		if (version_compare($sql_version, '5.0', '<'))-			$message[] = __('This CubeWP Add-on requires SQL 5.0 or higher. Version detected: ', 'cubewp-frontend') . ' ' . $sql_version;+			$message[] = __('This CubeWP Add-on requires SQL 5.0 or higher. Version detected: ', 'cubewp-framework') . ' ' . $sql_version;  		// Not empty $message means there are issues 		if (! empty($message)) {  			$error_message = implode("\n", $message);-			die(__('Sorry but your WordPress installation does not reach the minimum requirements for running this add-on. The following errors were given:', 'cubewp-frontend') . "\n" . $error_message);+			wp_die(+				esc_html__(+					'Sorry but your WordPress installation does not reach the minimum requirements for running this add-on. The following errors were given:',+					'cubewp-framework'+				) . "\n" . esc_html( $error_message )+			); 		}  		return $this->add_on_management($plugin);@@ -113,7 +118,7 @@ 						// If plugin is free 						if ($license_type == 'free') { 							CWP()->update_cubewp_options($slug . '_key', $key);-							unlink($file);+							wp_delete_file($file); 							return; 						} @@ -129,31 +134,31 @@ 						$response = wp_remote_post($this->route, array('timeout' => 15, 'sslverify' => false, 'body' => $api_params)); 						// make sure the response came back okay 						if (is_wp_error($response)) {-							die($file_is_not_valid);+							wp_die( esc_html( $file_is_not_valid ) ); 						} 						// decode the license data 						$response_data = json_decode(wp_remote_retrieve_body($response));  						if (isset($response_data->license)) { 							if ('valid' != $response_data->license) {-								die($lic_is_not_valid);+								wp_die( esc_html( $lic_is_not_valid ) ); 							} else { 								CWP()->update_cubewp_options($slug, $response_data); 								CWP()->update_cubewp_options($slug . '_key', $key); 								CWP()->update_cubewp_options($slug . '-status', $response_data->license); 							} 						} else {-							die($lic_is_not_valid);+							wp_die( esc_html( $lic_is_not_valid ) ); 						}-						unlink($file);+						wp_delete_file($file); 					} else { 						//file not good-						die($need_fresh_file);+						wp_die( esc_html( $need_fresh_file ) ); 					} 				} 			} else { 				//Plugin not good-				die($not_our_plugin);+				wp_die( esc_html( $not_our_plugin ) ); 			} 		} 	}@@ -310,7 +315,7 @@ 					if (file_exists($file)) { 						$key = file_get_contents($file); 						CWP()->update_cubewp_options($slug . '_key', $key);-						unlink($file);+						wp_delete_file($file); 						return; 					} else { 						$key = isset($add_ons[$plugin]['key']) ? $add_ons[$plugin]['key'] : '';

I'll analyze this code diff for security fixes.

Vulnerability 1:

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-add-ons.php - Lines 58, 64, 70, 74-79

Old Code:
```php
$message[] = __('This CubeWP Add-on requires WordPress 4.0 or higher. Version detected:', 'cubewp-frontend') . ' ' . $wp_version;
$message[] = __('This CubeWP Add-on requires PHP 5.3 or higher. Version detected: ', 'cubewp-frontend') . ' ' . $php_version;
$message[] = __('This CubeWP Add-on requires SQL 5.0 or higher. Version detected: ', 'cubewp-frontend') . ' ' . $sql_version;
die(__('Sorry but your WordPress installation does not reach the minimum requirements for running this add-on. The following errors were given:', 'cubewp-frontend') . "\n" . $error_message);
```

Fixed Code:
```php
$message[] = __('This CubeWP Add-on requires WordPress 4.0 or higher. Version detected:', 'cubewp-framework') . ' ' . $wp_version;
$message[] = __('This CubeWP Add-on requires PHP 5.3 or higher. Version detected: ', 'cubewp-framework') . ' ' . $php_version;
$message[] = __('This CubeWP Add-on requires SQL 5.0 or higher. Version detected: ', 'cubewp-framework') . ' ' . $sql_version;
wp_die(
    esc_html__(
        'Sorry but your WordPress installation does not reach the minimum requirements for running this add-on. The following errors were given:',
        'cubewp-framework'
    ) . "\n" . esc_html( $error_message )
);
```

Explanation: The old code concatenated unsanitized version strings directly into error messages that were then output via `die()`. The fixed code wraps the error message output in `esc_html()` to prevent XSS attacks. While version strings are unlikely to contain malicious content, proper output escaping is a security best practice to prevent injection attacks.

---

Vulnerability 2:

Vulnerability Existed: yes
TRUE POSITIVE
Improper Resource Handling - CWE-404 - cube/classes/class-cubewp-add-ons.php - Lines 121, 152, 318

Old Code:
```php
unlink($file);
```

Fixed Code:
```php
wp_delete_file($file);
```

Explanation: The old code used PHP's native `unlink()` function for file deletion. The fixed code uses WordPress's `wp_delete_file()` function, which provides better resource handling, proper error handling, and integrates with WordPress hooks and capabilities checks. This is more secure and maintainable within a WordPress context.

---

Vulnerability 3:

Vulnerability Existed: yes
FALSE POSITIVE
Information Disclosure - CWE-209 - cube/classes/class-cubewp-add-ons.php - Lines 137, 144, 147, 156, 160

Old Code:
```php
die($file_is_not_valid);
die($lic_is_not_valid);
die($not_our_plugin);
```

Fixed Code:
```php
wp_die( esc_html( $file_is_not_valid ) );
wp_die( esc_html( $lic_is_not_valid ) );
wp_die( esc_html( $not_our_plugin ) );
```

Explanation: The old code output error messages via `die()` without escaping. If these error variables contain user-controlled data or external input, they could be vulnerable to XSS attacks. Additionally, using `wp_die()` instead of `die()` is WordPress best practice as it allows for proper error handling, logging, and integration with WordPress's error display system. The `esc_html()` wrapper ensures any special characters are safely escaped.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-admin-enqueue.php	2026-01-18 00:20:47.465235293 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-admin-enqueue.php	2026-01-18 00:20:56.197777850 +0000@@ -1,4 +1,5 @@ <?php+ /**  * CubeWp Admin Enqueue.  *@@ -6,12 +7,13 @@  * @version 1.0  */ + // phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ if ( ! defined( 'ABSPATH' ) ) { 	exit; }  - /**  * CubeWp_Admin_Enqueue  */@@ -42,7 +44,7 @@ 	/** 	 * Method get_registered_types_types 	 *-	 * @return void+	 * @return array 	 * * @since  1.0.0 	 */ 	private static function get_registered_types_types() {@@ -79,7 +81,6 @@ 			} 	 			wp_reset_postdata();-			wp_reset_query(); 		} 	 		return $group_fields_values;@@ -88,7 +89,7 @@ 	/** 	 * Method get_cf_types_types 	 *-	 * @return void+	 * @return array 	 * * @since  1.0.0 	 */ 	private static function get_cf_types_types() {@@ -101,7 +102,7 @@     /**      * Method get_registered_taxonomies      *-     * @return void+     * @return array 	 * * @since  1.0.0      */     private static function get_registered_taxonomies() {@@ -461,7 +462,10 @@ 		                  -        echo apply_filters( 'admin/script/enqueue', '');+        $cubewp_admin_inline_output = apply_filters( 'admin/script/enqueue', '' );+        if ( ! empty( $cubewp_admin_inline_output ) ) {+            echo wp_kses_post( $cubewp_admin_inline_output );+        } 				 	}     

Based on my analysis of the code diff between versions 1.1.27 and 1.1.28, here are the security-relevant changes:

---

**Vulnerability Existed: yes**
TRUE POSITIVE

**Cross-Site Scripting (XSS) - CWE-79 - class-cubewp-admin-enqueue.php - Lines 464-467**

**Old Code:**
```php
echo apply_filters( 'admin/script/enqueue', '');
```

**Fixed Code:**
```php
$cubewp_admin_inline_output = apply_filters( 'admin/script/enqueue', '' );
if ( ! empty( $cubewp_admin_inline_output ) ) {
    echo wp_kses_post( $cubewp_admin_inline_output );
}
```

**Explanation:**
This is a valid security fix for an XSS vulnerability. The original code directly echoed the result of an `apply_filters()` call without sanitization. Filter callbacks could return malicious JavaScript or HTML that would be rendered in the page without escaping. The fix applies `wp_kses_post()`, a WordPress sanitization function that strips dangerous HTML/JavaScript while preserving safe markup (like `<a>`, `<strong>`, etc.). The added empty check is a best practice to prevent unnecessary function calls when the filtered value is empty.

---

**Additional Changes (Not Security Issues):**
- Added phpcs:disable comment (code quality, not a security fix)
- Removed redundant `wp_reset_query()` call (line 82 → removed at 83) - this is a best practice fix but not a security issue
- Updated docblock return types from `@return void` to `@return array` (documentation corrections, not security-related)

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-admin-notice.php	2026-01-18 00:20:47.465235293 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-admin-notice.php	2026-01-18 00:20:56.197777850 +0000@@ -79,7 +79,7 @@ 		$notice_ui .= '<p>' . cubewp_core_data( $this->message ) . '</p>'; 		$notice_ui .= '</div>'; -		print( $notice_ui );+		echo wp_kses_post( $notice_ui ); 	}  	/**@@ -175,14 +175,16 @@ 	 * @since  1.0.0 	 */ 	private static function cubewp_remove_notices_permanently() {+		/* phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing */ 		if ( isset( $_GET['cubewp-remove-notice-permanently'] ) && ! empty( $_GET['cubewp-remove-notice-permanently'] ) ) { 		   $permanently_removed_notices = get_option( 'permanently_removed_notices' ); 		   $permanently_removed_notices = ! empty( $permanently_removed_notices ) && is_array( $permanently_removed_notices ) ? $permanently_removed_notices : array();-		   $permanently_removed_notices[] = sanitize_text_field( $_GET['cubewp-remove-notice-permanently'] );+		   /* phpcs:ignore WordPress.Security.NonceVerification.Recommended */+		   $permanently_removed_notices[] = sanitize_text_field( wp_unslash($_GET['cubewp-remove-notice-permanently'] )); 		   update_option( 'permanently_removed_notices', $permanently_removed_notices ); 		   $current_url = cubewp_get_current_url(); 		   $current_url = remove_query_arg( 'cubewp-remove-notice-permanently', $current_url );-		   wp_redirect( esc_url( $current_url ) );+		   wp_safe_redirect( $current_url ); 		   exit; 		} 	}@@ -201,13 +203,24 @@ 			'wordpress' => [ 				'version' => CubeWp_Load::$wp_req_version, 				'i18n'    => [-					'requirements' => sprintf( __( 'CubeWP requires WordPress version %1$s or higher. You are using version %2$s. Please upgrade WordPress to use CubeWP.', 'cubewp-framework' ), CubeWp_Load::$wp_req_version, $GLOBALS['wp_version'] ),+					'requirements' => sprintf(+						/* translators: 1: Required WordPress version, 2: Current WordPress version */+						__( 'CubeWP requires WordPress version %1$s or higher. You are using version %2$s. Please upgrade WordPress to use CubeWP.', 'cubewp-framework' ),+						CubeWp_Load::$wp_req_version,+						$GLOBALS['wp_version']+					), 				], 			],-			'php'       => [+			'php' => [ 				'version' => CubeWp_Load::$php_req_version, 				'i18n'    => [-					'requirements' => sprintf( __( 'CubeWP requires PHP version %1$s or higher. You are using version %2$s. Please <a href="%3$s">upgrade PHP</a> to use CubeWP.', 'cubewp-framework' ), CubeWp_Load::$php_req_version, PHP_VERSION, 'https://wordpress.org/support/upgrade-php/' ),+					'requirements' => sprintf(+						/* translators: 1: Required PHP version, 2: Current PHP version, 3: URL to upgrade PHP */+						__( 'CubeWP requires PHP version %1$s or higher. You are using version %2$s. Please <a href="%3$s">upgrade PHP</a> to use CubeWP.', 'cubewp-framework' ),+						CubeWp_Load::$php_req_version,+						PHP_VERSION,+						'https://wordpress.org/support/upgrade-php/'+					), 				], 			], 		];

Vulnerability Existed: yes
TRUE POSITIVE
[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] - CWE-79 - cube/classes/class-cubewp-admin-notice.php [82]
Old Code:
```
print( $notice_ui );
```
Fixed Code:
```
echo wp_kses_post( $notice_ui );
```
Explanation:
The original code directly printed HTML content without sanitization, creating a stored XSS vulnerability. The `$notice_ui` variable contains user-controlled data (`$this->message`) that could contain malicious JavaScript. The fix applies `wp_kses_post()` which strips unsafe HTML tags and attributes while allowing safe markup, preventing XSS attacks.

---

Vulnerability Existed: yes
FALSE POSITIVE
[Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')] - CWE-89 - cube/classes/class-cubewp-admin-notice.php [181]
Old Code:
```
$permanently_removed_notices[] = sanitize_text_field( $_GET['cubewp-remove-notice-permanently'] );
```
Fixed Code:
```
$permanently_removed_notices[] = sanitize_text_field( wp_unslash($_GET['cubewp-remove-notice-permanently'] ));
```
Explanation:
While `sanitize_text_field()` removes tags, it doesn't remove the WordPress magic quotes added by `wp_magic_quotes()`. The `wp_unslash()` function properly removes these quotes before sanitization. Without it, escaped slashes and quotes could be stored incorrectly in the database, potentially causing data corruption or bypassing intended security controls. This is a best-practice fix for handling `$_GET` data in WordPress.

---

Vulnerability Existed: yes
TRUE POSITIVE
[Improper Restriction of Rendered UI Layers or Frames] - CWE-1021 - cube/classes/class-cubewp-admin-notice.php [185]
Old Code:
```
wp_redirect( esc_url( $current_url ) );
```
Fixed Code:
```
wp_safe_redirect( $current_url );
```
Explanation:
The original code used `esc_url()` with `wp_redirect()`, which only escapes the URL for HTML context. `wp_safe_redirect()` is the proper WordPress function that validates the redirect target is local (not to an external domain) before redirecting, preventing open redirect vulnerabilities. `wp_safe_redirect()` handles URL escaping internally, so the URL should not be pre-escaped.

---

Vulnerability Existed: no
[N/A - Code Quality/Documentation] - N/A - cube/classes/class-cubewp-admin-notice.php [178-179, 203-224]
Old Code:
```
if ( isset( $_GET['cubewp-remove-notice-permanently'] ) && ! empty( $_GET['cubewp-remove-notice-permanently'] ) ) {
```
Fixed Code:
```
/* phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing */
if ( isset( $_GET['cubewp-remove-notice-permanently'] ) && ! empty( $_GET['cubewp-remove-notice-permanently'] ) ) {
```
Explanation:
The phpcs comments added don't fix vulnerabilities but suppress PHPCS warnings about missing nonce verification. While missing nonce verification is technically a security concern (CWE-352: Cross-Site Request Forgery), the comment only suppresses the warning rather than implementing actual nonce verification. This is a code quality change rather than a security fix. True mitigation would require adding nonce verification with `wp_verify_nonce()`.

---

Vulnerability Existed: no
[N/A - Code Formatting] - N/A - cube/classes/class-cubewp-admin-notice.php [203-224]
Old Code:
```
'requirements' => sprintf( __( 'CubeWP requires WordPress version...', 'cubewp-framework' ), CubeWp_Load::$wp_req_version, $GLOBALS['wp_version'] ),
```
Fixed Code:
```
'requirements' => sprintf(
    /* translators: 1: Required WordPress version, 2: Current WordPress version */
    __( 'CubeWP requires WordPress version...', 'cubewp-framework' ),
    CubeWp_Load::$wp_req_version,
    $GLOBALS['wp_version']
),
```
Explanation:
These changes are code formatting and documentation improvements (adding translator comments for i18n). They do not address security vulnerabilities. The translator comments help translators understand parameter meaning but do not affect security posture.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-admin.php	2026-01-18 00:20:47.465235293 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-admin.php	2026-01-18 00:20:56.197777850 +0000@@ -98,13 +98,17 @@      */     public static function cubewp_get_builder_widgets() { -        if ( ! wp_verify_nonce($_POST['security_nonce'], "cubewp-admin-nonce")) {+        if ( empty( $_POST['security_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['security_nonce'] ) ), 'cubewp-admin-nonce' ) ) { 			wp_send_json_error(array( 				'msg' => esc_html__('Sorry! Security Verification Failed.', 'cubewp-framework'), 			), 404); 		}-        -        $widgets_ui = self::cubewp_builder_widgets_display($_POST['nested_switcher'],$_POST['form_type'],$_POST['slug']);++		$nested_switcher = isset( $_POST['nested_switcher'] ) ? sanitize_text_field( wp_unslash( $_POST['nested_switcher'] ) ) : '';+		$form_type       = isset( $_POST['form_type'] ) ? sanitize_text_field( wp_unslash( $_POST['form_type'] ) ) : '';+		$slug            = isset( $_POST['slug'] ) ? sanitize_key( wp_unslash( $_POST['slug'] ) ) : '';++		$widgets_ui = self::cubewp_builder_widgets_display( $nested_switcher, $form_type, $slug ); 		wp_send_json_success(array( 'sidebar' => $widgets_ui)); 	} @@ -117,14 +121,15 @@      * @since  1.0.0      */     public static function cubewp_process_post_card_css() {-        if ( ! wp_verify_nonce($_POST['security_nonce'], "cubewp-admin-nonce")) {+        if ( empty( $_POST['security_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['security_nonce'] ) ), 'cubewp-admin-nonce' ) ) { 			wp_send_json_error(array( 				'msg' => esc_html__('Sorry! Security Verification Failed.', 'cubewp-framework'), 			), 404); 		}-        if (isset($_POST['styles']) && is_string($_POST['styles'])) {--            $data = json_decode(stripslashes($_POST['styles']), true);+        if ( isset( $_POST['styles'] ) ) {+            /*phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized */+            $raw_styles = wp_unslash( $_POST['styles'] );+            $data = is_string( $raw_styles ) ? json_decode( $raw_styles, true ) : null;             if (is_array($data)) {                 $cleaned_data = array_map(function($item) {                     // Remove surrounding quotes@@ -133,6 +138,8 @@                     $item = str_replace('\n', "\n", $item);                     // Replace plus signs with spaces                     $item = str_replace('+', ' ', $item);+                    // Sanitize each line as textarea content to avoid unsafe content+                    $item = sanitize_textarea_field( $item );                     return $item;                 }, $data); @@ -144,8 +151,8 @@                 }                 $file_path = CUBEWP_POST_CARDS_DIR . '/cubewp-post-cards.css';     -                if (!file_exists(dirname($file_path))) {-                    mkdir(dirname($file_path), 0755, true);+                if ( ! file_exists( dirname( $file_path ) ) ) {+                    wp_mkdir_p( dirname( $file_path ) );                 }                      if (file_put_contents($file_path, $css_code) !== false) {@@ -216,20 +223,20 @@             return null;         }         $modules = array(-            'custom-fields' => 'modules/',-            'theme-builder'  => 'modules/',-            'post-types' => 'modules/',-            'users'      => 'modules/',-            'search'     => 'modules/',-            'settings'   => 'modules/',-            'taxonomies' => 'modules/',-            'list-tables'=> 'modules/',-            'elementor'  => 'modules/',-            'recaptcha'  => 'modules/',-            'builder'  => 'modules/',-            -            'widgets'    => 'includes/',-            'shortcodes' => 'includes/',+            'custom-fields'     => 'modules/',+            'theme-builder'     => 'modules/',+            'post-types'        => 'modules/',+            'users'             => 'modules/',+            'search'            => 'modules/',+            'settings'          => 'modules/',+            'taxonomies'        => 'modules/',+            'list-tables'       => 'modules/',+            'elementor'         => 'modules/',+            'elementor/taxonomy'=> 'modules/',+            'recaptcha'         => 'modules/',+            'builder'           => 'modules/',+            'widgets'           => 'includes/',+            'shortcodes'        => 'includes/',         );         foreach($modules as $module=>$path){             $file_name = $path.$module.'/class-' .str_replace('_', '-', strtolower($className)).'.php';@@ -240,7 +247,6 @@             }         } -                 return;     }     @@ -315,12 +321,15 @@         $single_tags = array(             "title" => esc_html__("Post Title", "cubewp-framework"),             "post_content" => esc_html__("Post Content", "cubewp-framework"),+            "post_excerpt" => esc_html__("Post Excerpt", "cubewp-framework"),             "featured_image" => esc_html__("Featured Image", "cubewp-framework"),             "post_author" => esc_html__("Post Author", "cubewp-framework"),             "post_info" => esc_html__("Post Info", "cubewp-framework"),             "post_term" => esc_html__("Post Term", "cubewp-framework"),             "post_share" => esc_html__("Post Share Button", "cubewp-framework"),             "post_save" => esc_html__("Post Save Button", "cubewp-framework"),+            "post_url" => esc_html__("Post URL", "cubewp-framework"),+            "post_date" => esc_html__("Post Date", "cubewp-framework"),             "custom_fields" => esc_html__("CubeWP Custom Fields", "cubewp-framework")         );         foreach ( $single_tags as $tag => $label ) {@@ -329,31 +338,69 @@                 $module->register( new $tag() );             }         }++        $module->register_group( 'cubewp-taxonomy-fields', [+            'title' => esc_html__( 'CubeWP Taxonomy Custom Fields', 'cubewp-framework' ),+        ] );+        $taxonomy_tags = array(+            "term_name" => esc_html__("Term Name", "cubewp-framework"),+            "term_url" => esc_html__("Term URL", "cubewp-framework"),+            "term_count" => esc_html__("Term Count", "cubewp-framework"),+            "term_description" => esc_html__("Term Description", "cubewp-framework"),+            "taxonomy_text" => esc_html__("Field Type (Text)", "cubewp-framework"),+            "taxonomy_textarea" => esc_html__("Field Type (Textarea)", "cubewp-framework"),+            "taxonomy_image" => esc_html__("Field Type (Image)", "cubewp-framework"),+            "taxonomy_color" => esc_html__("Field Type (Color)", "cubewp-framework"),+            "taxonomy_url" => esc_html__("Field Type (URL)", "cubewp-framework"),+            "taxonomy_gallery" => esc_html__("Field Type (Gallery)", "cubewp-framework"),+            "taxonomy_oembed" => esc_html__("Field Type (oEembed)", "cubewp-framework"),+            "taxonomy_google_address" => esc_html__("Field Type (Google Address)", "cubewp-framework"),+        );+        foreach ( $taxonomy_tags as $tag => $label ) {+            $tag = 'CubeWp_Tag_'.ucfirst($tag);+            if(class_exists($tag)){+                $module->register( new $tag() );+            }+        }     }      public function cubewp_updated_post_type_messages( $messages ) {+        /* phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing */         global $post, $post_ID;         $post_types = get_post_types( array( 'show_ui' => true, '_builtin' => false ), 'objects' );         foreach ( $post_types as $post_type => $post_object ) {            $messages[ $post_type ] = array(               0  => '', // Unused. Messages start at index 1.-              1  => sprintf( __( '%s updated. <a href="%s">View %s</a>' ), $post_object->labels->singular_name, esc_url( get_permalink( $post_ID ) ), $post_object->labels->singular_name ),-              2  => __( 'Custom field updated.' ),-              3  => __( 'Custom field deleted.' ),-              4  => sprintf( __( '%s updated.' ), $post_object->labels->singular_name ),-              5  => isset( $_GET['revision'] ) ? sprintf( __( '%s restored to revision from %s' ), $post_object->labels->singular_name, wp_post_revision_title( (int) $_GET['revision'], false ) ) : false,-              6  => sprintf( __( '%s published. <a href="%s">View %s</a>' ), $post_object->labels->singular_name, esc_url( get_permalink( $post_ID ) ), $post_object->labels->singular_name ),-              7  => sprintf( __( '%s saved.' ), $post_object->labels->singular_name ),-              8  => sprintf( __( '%s submitted. <a target="_blank" href="%s">Preview %s</a>' ), $post_object->labels->singular_name, esc_url( add_query_arg( 'preview', 'true', get_permalink( $post_ID ) ) ), $post_object->labels->singular_name ),-              9  => sprintf( __( '%s scheduled for: <strong>%1$s</strong>. <a target="_blank" href="%2$s">Preview %s</a>' ), $post_object->labels->singular_name, date_i18n( __( 'M j, Y @ G:i' ), strtotime( $post->post_date ) ), esc_url( get_permalink( $post_ID ) ), $post_object->labels->singular_name ),-              10 => sprintf( __( '%s draft updated. <a target="_blank" href="%s">Preview %s</a>' ), $post_object->labels->singular_name, esc_url( add_query_arg( 'preview', 'true', get_permalink( $post_ID ) ) ), $post_object->labels->singular_name ),+              /* translators: 1: Post type singular name, 2: URL to view, 3: Post type singular name */+              1  => sprintf( __( '%1$s updated. <a href="%2$s">View %3$s</a>', 'cubewp-framework' ), $post_object->labels->singular_name, esc_url( get_permalink( $post_ID ) ), $post_object->labels->singular_name ),+              2  => __( 'Custom field updated.', 'cubewp-framework' ),+              3  => __( 'Custom field deleted.', 'cubewp-framework' ),+              /* translators: 1: Post type singular name */+              4  => sprintf( __( '%1$s updated.', 'cubewp-framework' ), $post_object->labels->singular_name ),+              /* translators: 1: Post type singular name, 2: Revision title*/+              5  => isset( $_GET['revision'] ) ? sprintf( __( '%1$s restored to revision from %2$s', 'cubewp-framework' ), $post_object->labels->singular_name, wp_post_revision_title( (int) sanitize_text_field(wp_unslash($_GET['revision'])), false ) ) : false,/* phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed. WordPress.Security.NonceVerification.Missing -- Back-compat: legacy admin form may not include a nonce. */+              /* translators: 1: Post type singular name, 2: URL to view, 3: Post type singular name */+              6  => sprintf( __( '%1$s published. <a href="%2$s">View %3$s</a>', 'cubewp-framework' ), $post_object->labels->singular_name, esc_url( get_permalink( $post_ID ) ), $post_object->labels->singular_name ),+              /* translators: 1: Post type singular name */+              7  => sprintf( __( '%1$s saved.', 'cubewp-framework' ), $post_object->labels->singular_name ),+              /* translators: 1: Post type singular name, 2: URL to preview, 3: Post type singular name */+              8  => sprintf( __( '%1$s submitted. <a target="_blank" href="%2$s">Preview %3$s</a>', 'cubewp-framework' ), $post_object->labels->singular_name, esc_url( add_query_arg( 'preview', 'true', get_permalink( $post_ID ) ) ), $post_object->labels->singular_name ),+              /* translators: 1: Post type singular name, 2: Scheduled date, 3: URL to preview, 4: Post type singular name */+              9  => sprintf( __( '%1$s scheduled for: <strong>%2$s</strong>. <a target="_blank" href="%3$s">Preview %4$s</a>', 'cubewp-framework' ), $post_object->labels->singular_name, date_i18n( __( 'M j, Y @ G:i', 'cubewp-framework' ), strtotime( $post->post_date ) ), esc_url( get_permalink( $post_ID ) ), $post_object->labels->singular_name ),+              /* translators: 1: Post type singular name, 2: URL to preview, 3: Post type singular name */+              10 => sprintf( __( '%1$s draft updated. <a target="_blank" href="%2$s">Preview %3$s</a>', 'cubewp-framework' ), $post_object->labels->singular_name, esc_url( add_query_arg( 'preview', 'true', get_permalink( $post_ID ) ) ), $post_object->labels->singular_name ),            );            if ($post_type == 'price_plan') {-              $messages[ $post_type ][1] = sprintf( __( '%s updated.' ), $post_object->labels->singular_name );-              $messages[ $post_type ][6] = sprintf( __( '%s published.' ), $post_object->labels->singular_name );-              $messages[ $post_type ][8] = sprintf( __( '%s submitted.' ), $post_object->labels->singular_name );-              $messages[ $post_type ][9] = sprintf( __( '%s scheduled for: <strong>%1$s</strong>.' ), $post_object->labels->singular_name, date_i18n( __( 'M j, Y @ G:i' ), strtotime( $post->post_date ) ) );-              $messages[ $post_type ][10] = sprintf( __( '%s draft updated.' ), $post_object->labels->singular_name );+              /* translators: 1: Post type singular name */+              $messages[ $post_type ][1] = sprintf( __( '%1$s updated.', 'cubewp-framework' ), $post_object->labels->singular_name );+              /* translators: 1: Post type singular name */+              $messages[ $post_type ][6] = sprintf( __( '%1$s published.', 'cubewp-framework' ), $post_object->labels->singular_name );+              /* translators: 1: Post type singular name */+              $messages[ $post_type ][8] = sprintf( __( '%1$s submitted.', 'cubewp-framework' ), $post_object->labels->singular_name );+              /* translators: 1: Post type singular name, 2: Scheduled date */+              $messages[ $post_type ][9] = sprintf( __( '%1$s scheduled for: <strong>%2$s</strong>.', 'cubewp-framework' ), $post_object->labels->singular_name, date_i18n( __( 'M j, Y @ G:i', 'cubewp-framework' ), strtotime( $post->post_date ) ) );+              /* translators: 1: Post type singular name */+              $messages[ $post_type ][10] = sprintf( __( '%1$s draft updated.', 'cubewp-framework' ), $post_object->labels->singular_name );            }         }      @@ -684,6 +731,7 @@         register_post_status( 'inactive', array(             'label'                     => _x( 'Inactive ', 'Inactive', 'cubewp-framework' ),             'public'                    => true,+            /* translators: %s: number of posts. */             'label_count'               => _n_noop( 'Inactive s <span class="count">(%s)</span>', 'Inactive s <span class="count">(%s)</span>', 'cubewp-framework' ),             'post_type'                 => array( 'cubewp-tb'),              'show_in_admin_all_list'    => true,

Now I'll provide the security analysis of the diff as requested:

---

## Security Analysis Results

**Vulnerability 1:**

Vulnerability Existed: yes
TRUE POSITIVE

**Improper Input Validation - CWE-20 - cube/classes/class-cubewp-admin.php - Lines 101-107**

Old Code:
```php
if ( ! wp_verify_nonce($_POST['security_nonce'], "cubewp-admin-nonce")) {
    wp_send_json_error(array(
        'msg' => esc_html__('Sorry! Security Verification Failed.', 'cubewp-framework'),
    ), 404);
}

$widgets_ui = self::cubewp_builder_widgets_display($_POST['nested_switcher'],$_POST['form_type'],$_POST['slug']);
```

Fixed Code:
```php
if ( empty( $_POST['security_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['security_nonce'] ) ), 'cubewp-admin-nonce' ) ) {
    wp_send_json_error(array(
        'msg' => esc_html__('Sorry! Security Verification Failed.', 'cubewp-framework'),
    ), 404);
}

$nested_switcher = isset( $_POST['nested_switcher'] ) ? sanitize_text_field( wp_unslash( $_POST['nested_switcher'] ) ) : '';
$form_type       = isset( $_POST['form_type'] ) ? sanitize_text_field( wp_unslash( $_POST['form_type'] ) ) : '';
$slug            = isset( $_POST['slug'] ) ? sanitize_key( wp_unslash( $_POST['slug'] ) ) : '';

$widgets_ui = self::cubewp_builder_widgets_display( $nested_switcher, $form_type, $slug );
```

Explanation: The original code directly accessed $_POST superglobal variables without sanitization or validation. The fix adds proper input validation by: (1) checking if the nonce exists before verification, (2) sanitizing the nonce input with sanitize_text_field() and wp_unslash(), (3) properly checking if POST variables exist with isset(), and (4) sanitizing each POST variable with appropriate functions (sanitize_text_field for strings, sanitize_key for slugs) before passing to functions.

---

**Vulnerability 2:**

Vulnerability Existed: yes
TRUE POSITIVE

**Improper Input Validation - CWE-20 - cube/classes/class-cubewp-admin.php - Lines 124-138**

Old Code:
```php
if ( ! wp_verify_nonce($_POST['security_nonce'], "cubewp-admin-nonce")) {
    wp_send_json_error(array(
        'msg' => esc_html__('Sorry! Security Verification Failed.', 'cubewp-framework'),
    ), 404);
}
if (isset($_POST['styles']) && is_string($_POST['styles'])) {
    $data = json_decode(stripslashes($_POST['styles']), true);
```

Fixed Code:
```php
if ( empty( $_POST['security_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['security_nonce'] ) ), 'cubewp-admin-nonce' ) ) {
    wp_send_json_error(array(
        'msg' => esc_html__('Sorry! Security Verification Failed.', 'cubewp-framework'),
    ), 404);
}
if ( isset( $_POST['styles'] ) ) {
    /*phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized */
    $raw_styles = wp_unslash( $_POST['styles'] );
    $data = is_string( $raw_styles ) ? json_decode( $raw_styles, true ) : null;
```

Explanation: The original code used stripslashes() which is deprecated and inconsistent with WordPress security standards. The fix uses wp_unslash() instead, which is the WordPress-standard way to handle magic quotes. The check is also improved by testing if the data is a string after unslashing rather than before. Additionally, a phpcs comment indicates the team is intentionally handling this with special care for JSON payload validation.

---

**Vulnerability 3:**

Vulnerability Existed: yes
TRUE POSITIVE

**Missing Input Sanitization - CWE-400 - cube/classes/class-cubewp-admin.php - Lines 137-140**

Old Code:
```php
$data = json_decode(stripslashes($_POST['styles']), true);
if (is_array($data)) {
    $cleaned_data = array_map(function($item) {
        // Remove surrounding quotes
        $item = str_replace('"', '', $item);
        $item = str_replace('\n', "\n", $item);
        // Replace plus signs with spaces
        $item = str_replace('+', ' ', $item);
        return $item;
```

Fixed Code:
```php
$data = is_string( $raw_styles ) ? json_decode( $raw_styles, true ) : null;
if (is_array($data)) {
    $cleaned_data = array_map(function($item) {
        // Remove surrounding quotes
        $item = str_replace('"', '', $item);
        $item = str_replace('\n', "\n", $item);
        // Replace plus signs with spaces
        $item = str_replace('+', ' ', $item);
        // Sanitize each line as textarea content to avoid unsafe content
        $item = sanitize_textarea_field( $item );
        return $item;
```

Explanation: The original code performed string replacements on JSON-decoded CSS data without proper sanitization. This could allow unsafe content to reach the CSS file. The fix adds sanitize_textarea_field() to each item, ensuring that any potentially unsafe content is properly escaped before being written to the CSS file.

---

**Vulnerability 4:**

Vulnerability Existed: yes
TRUE POSITIVE

**Improper Resource Validation - CWE-434 - cube/classes/class-cubewp-admin.php - Lines 154-157**

Old Code:
```php
if (!file_exists(dirname($file_path))) {
    mkdir(dirname($file_path), 0755, true);
}
```

Fixed Code:
```php
if ( ! file_exists( dirname( $file_path ) ) ) {
    wp_mkdir_p( dirname( $file_path ) );
}
```

Explanation: The original code uses PHP's native mkdir() function with world-readable permissions (0755). The fix uses WordPress's wp_mkdir_p() function, which properly handles directory creation with appropriate WordPress context, including proper permission handling and logging. This prevents potential privilege escalation or insecure directory permissions.

---

**Vulnerability 5:**

Vulnerability Existed: yes
FALSE POSITIVE

**Improper Input Validation - CWE-20 - cube/classes/class-cubewp-admin.php - Lines 361-362**

Old Code:
```php
5  => isset( $_GET['revision'] ) ? sprintf( __( '%s restored to revision from %s' ), $post_object->labels->singular_name, wp_post_revision_title( (int) $_GET['revision'], false ) ) : false,
```

Fixed Code:
```php
5  => isset( $_GET['revision'] ) ? sprintf( __( '%1$s restored to revision from %2$s', 'cubewp-framework' ), $post_object->labels->singular_name, wp_post_revision_title( (int) sanitize_text_field(wp_unslash($_GET['revision'])), false ) ) : false,/* phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed. WordPress.Security.NonceVerification.Missing -- Back-compat: legacy admin form may not include a nonce. */
```

Explanation: The original code cast $_GET['revision'] to integer without sanitization, which could be unsafe. While the cast to (int) provides some protection, the fix adds explicit sanitization with sanitize_text_field(wp_unslash($_GET['revision'])) before casting, making the intention explicit and following WordPress security standards. The phpcs comment indicates the team acknowledges this is read-only usage without state changes.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-builder-pro.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-builder-pro.php	2026-01-18 00:20:56.197777850 +0000@@ -57,18 +57,18 @@             $background_image_src = CWP_PLUGIN_URI.'cube/assets/admin/images/user-dashboard-screen.png';         } 		echo'<div id="cubewp-title-bar">-		<h1>'.$page_header.'</h1>+		<h1>'.esc_html($page_header).'</h1> 		</div> 		<div class="cubewp-subscription-frame">-			<img class="cubewp-subscription-frame-bg" src="'.$background_image_src.'" alt="">+			<img class="cubewp-subscription-frame-bg" src="'.esc_url($background_image_src).'" alt=""> 			<div class="cubewp-subscription-main"> 				<div class="cubewp-subscription-form">-					<div class="cube-subscription-header" style="background-image: url('.CWP_PLUGIN_URI.'cube/assets/admin/images/[email protected])">-						<img class="subscription-header-super" src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/wp-super.png" alt="image">+					<div class="cube-subscription-header" style="background-image: url('.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/addon-pop-header-2x.png').')">+						<img class="subscription-header-super" src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/wp-super.png').'" alt="image"> 					</div> 					<div class="cubewp-subscription-contant"> 						<div class="cubewp-subscription-logo">-							 <img src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/cube-logo.svg" alt="">+							 <img src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/cube-logo.svg').'" alt=""> 						</div> 						<div class="cube-popup-title"> 							<h2>Unlock (8) Super Powerful Frontend Builders</h2>@@ -93,7 +93,7 @@ 								<span class="cube-award-option">Create Your Own Test Sandbox Powered by</span> 							</div> 							<div class="cubewp-logo">-								<img src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/demowp.png" alt="">+								<img src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/demowp.png').'" alt=""> 							</div> 						</div> 					</div>

I'll analyze this code diff for security fixes.

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-builder-pro.php [60]
Old Code:
```
<h1>'.$page_header.'</h1>
```
Fixed Code:
```
<h1>'.esc_html($page_header).'</h1>
```
Explanation:
The `$page_header` variable is directly echoed into HTML without sanitization. An attacker could inject malicious JavaScript through this variable. The fix applies `esc_html()` to escape HTML entities and prevent XSS attacks.

---

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-builder-pro.php [63]
Old Code:
```
<img class="cubewp-subscription-frame-bg" src="'.$background_image_src.'" alt="">
```
Fixed Code:
```
<img class="cubewp-subscription-frame-bg" src="'.esc_url($background_image_src).'" alt="">
```
Explanation:
The `$background_image_src` variable is used directly in the `src` attribute without sanitization. Malicious URLs could be injected. The fix applies `esc_url()` to sanitize URLs and prevent XSS attacks via the `src` attribute.

---

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-builder-pro.php [66-67]
Old Code:
```
<div class="cube-subscription-header" style="background-image: url('.CWP_PLUGIN_URI.'cube/assets/admin/images/[email protected])">
<img class="subscription-header-super" src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/wp-super.png" alt="image">
```
Fixed Code:
```
<div class="cube-subscription-header" style="background-image: url('.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/addon-pop-header-2x.png').')">
<img class="subscription-header-super" src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/wp-super.png').'" alt="image">
```
Explanation:
While `CWP_PLUGIN_URI` is a constant and less risky, applying `esc_url()` to URLs in attributes and CSS properties ensures defense-in-depth. This prevents potential vulnerabilities if the constant could be tampered with or if the code structure changes. Note: The filename also changed from `[email protected]` to `addon-pop-header-2x.png`.

---

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-builder-pro.php [71]
Old Code:
```
<img src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/cube-logo.svg" alt="">
```
Fixed Code:
```
<img src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/cube-logo.svg').'" alt="">
```
Explanation:
Same as above—URLs in `src` attributes should be sanitized with `esc_url()` to prevent XSS attacks, even when using plugin constants.

---

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-builder-pro.php [96]
Old Code:
```
<img src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/demowp.png" alt="">
```
Fixed Code:
```
<img src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/demowp.png').'" alt="">
```
Explanation:
Same XSS vulnerability pattern—unsanitized URL in `src` attribute. The fix applies `esc_url()` for proper sanitization.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-builder-ui.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-builder-ui.php	2026-01-18 00:20:56.197777850 +0000@@ -152,7 +152,7 @@ 		$groups = cwp_get_groups_by_post_type($post_type); 		if (isset($groups) && !empty($groups) && count($groups) > 0) { 			foreach ($groups as $group) {-				$widgets_ui .= '<div id="group-' . rand(000000, 999999) . '" class="cubewp-builder-section cubewp-expand-container">';+				$widgets_ui .= '<div id="group-' . wp_rand(000000, 999999) . '" class="cubewp-builder-section cubewp-expand-container">'; 				$widgets_ui .= '<div class="cubewp-builder-section-header">'; 				$widgets_ui .= '<h3>' . esc_html(get_the_title($group)) . '</h3>'; 				$widgets_ui .= '<a href="https://cubewp.com/cubewp-frontend-pro/" target="_blank"><span class="cubewp-pro-tag">' . esc_html__("PRO", "cubewp-framework") . '</span></a>';@@ -403,7 +403,7 @@ 		$options = self::$tab_options; 		if (isset($options) && count($options) > 0) { 			foreach ($options as $slug => $option) {-				$output .= '<div id="type-' . esc_attr__($slug) . '" class="cubewp-type-container cubewp-switcher-tab-' . esc_attr__($slug) . ' cubewp-tab-switcher-target">';+				$output .= '<div id="type-' . esc_attr($slug) . '" class="cubewp-type-container cubewp-switcher-tab-' . esc_attr($slug) . ' cubewp-tab-switcher-target">'; 				if (! $option["switcher"]) { 					$output .= self::cubewp_builder_area_content($slug, $data); 				} else {@@ -412,7 +412,7 @@ 						foreach ($switcher["options"] as $id => $val) { 							$data['content_switcher'] = $id; 							$data_type = self::cubewp_check_switcher_type($id);-							$output .= '<div id="plan-' . esc_attr__($id) . '" class="cubewp-plan-tab cubewp-switcher-tab-' . esc_attr__($id) . ' cubewp-tab-switcher-target" data-id="' . esc_attr__($id) . '" ' . $data_type . '>';+							$output .= '<div id="plan-' . esc_attr($id) . '" class="cubewp-plan-tab cubewp-switcher-tab-' . esc_attr($id) . ' cubewp-tab-switcher-target" data-id="' . esc_attr($id) . '" ' . $data_type . '>'; 							$output .= self::cubewp_builder_area_content($slug, $data); 							$output .= '</div>'; 						}@@ -532,7 +532,7 @@ 		$options = self::$tab_options; 		if (isset($options) && count($options) > 0) { 			foreach ($options as $slug => $option) {-				$output .= '<div id="type-' . esc_attr__($slug) . '" class="cubewp-type-container cubewp-switcher-tab-' . esc_attr__($slug) . ' cubewp-tab-switcher-target">';+				$output .= '<div id="type-' . esc_attr($slug) . '" class="cubewp-type-container cubewp-switcher-tab-' . esc_attr($slug) . ' cubewp-tab-switcher-target">'; 				$output .= self::cubewp_builder_area_content($slug, $data); 				$output .= '</div>'; 			}

Vulnerability Existed: yes
FALSE POSITIVE
[CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)] - [CWE-338] - [cube/classes/class-cubewp-builder-ui.php] [Line 155]
[Old Code]
$widgets_ui .= '<div id="group-' . rand(000000, 999999) . '" class="cubewp-builder-section cubewp-expand-container">';
[Fixed Code]
$widgets_ui .= '<div id="group-' . wp_rand(000000, 999999) . '" class="cubewp-builder-section cubewp-expand-container">';
Explanation:
The `rand()` function is a weak PRNG and should not be used for generating IDs that could be predictable. The fix replaces it with `wp_rand()`, which is WordPress's recommended random number generator that uses better entropy sources. While this is primarily an ID generation context (lower severity than cryptographic use), using weak RNG can still lead to predictable element IDs, which could facilitate certain attack vectors.

---

Vulnerability Existed: yes
TRUE POSITIVE
[CWE-116: Improper Encoding or Escaping of Output] - [CWE-116] - [cube/classes/class-cubewp-builder-ui.php] [Lines 406, 415, 535]
[Old Code]
$output .= '<div id="type-' . esc_attr__($slug) . '" class="cubewp-type-container cubewp-switcher-tab-' . esc_attr__($slug) . ' cubewp-tab-switcher-target">';
$output .= '<div id="plan-' . esc_attr__($id) . '" class="cubewp-plan-tab cubewp-switcher-tab-' . esc_attr__($id) . ' cubewp-tab-switcher-target" data-id="' . esc_attr__($id) . '" ' . $data_type . '>';
[Fixed Code]
$output .= '<div id="type-' . esc_attr($slug) . '" class="cubewp-type-container cubewp-switcher-tab-' . esc_attr($slug) . ' cubewp-tab-switcher-target">';
$output .= '<div id="plan-' . esc_attr($id) . '" class="cubewp-plan-tab cubewp-switcher-tab-' . esc_attr($id) . ' cubewp-tab-switcher-target" data-id="' . esc_attr($id) . '" ' . $data_type . '>';
Explanation:
The `esc_attr__()` function is used for both escaping AND translation, but when the variable is not a translatable string literal, using `esc_attr__()` is incorrect and may not properly escape the output. The fix uses `esc_attr()` instead, which is the proper function for escaping HTML attributes without translation. This prevents potential XSS vulnerabilities if malicious data enters these variables.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-elementor.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-elementor.php	2026-01-18 00:20:56.197777850 +0000@@ -162,7 +162,8 @@ 				if (class_exists($class)) { 					$widgets_manager->register(new $class()); 				}else {-					wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), $class));+					/* translators: %s: class name. */+					wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), esc_html($class))); 				} 			} 		}

Vulnerability Existed: yes
FALSE POSITIVE
[Cross-Site Scripting (XSS)] - [CWE-79] - [cube/classes/class-cubewp-elementor.php] [Lines 165-166]

Old Code:
```php
wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), $class));
```

Fixed Code:
```php
/* translators: %s: class name. */
wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), esc_html($class)));
```

Explanation:
The vulnerability existed because `$class` was being passed directly into `sprintf()` without sanitization, even though the format string itself was escaped with `esc_html__()`. The `esc_html__()` function only escapes the translatable string template, not the variable substituted into it via `sprintf()`. If `$class` contained user-controlled or untrusted data with HTML/JavaScript, it could execute arbitrary scripts in the admin context. The fix properly escapes the `$class` variable using `esc_html()` before it's inserted into the message, preventing XSS attacks. The added translator comment also improves localization clarity.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-enqueue.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-enqueue.php	2026-01-18 00:20:56.197777850 +0000@@ -6,6 +6,8 @@  * @package cubewp/cube/classes  */ +// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ if ( ! defined( 'ABSPATH' ) ) { 	exit; }@@ -80,7 +82,10 @@ 			} 		} -		echo apply_filters( 'frontend/script/enqueue', '' );+		$cubewp_front_inline = apply_filters( 'frontend/script/enqueue', '' );+		if ( ! empty( $cubewp_front_inline ) ) {+			echo wp_kses_post( $cubewp_front_inline );+		} 		self::cubewp_enqueue_settings_css_js();  	}@@ -359,9 +364,10 @@ 			  global $cwpOptions; 			  $cwpOptions = ! empty( $cwpOptions ) && is_array( $cwpOptions ) ? $cwpOptions : get_option( 'cwpOptions' ); 			  $cubewp_css = isset( $cwpOptions['cubewp-css'] ) && ! empty( $cwpOptions['cubewp-css'] ) ? $cwpOptions['cubewp-css'] : '';-			  echo '<style type="text/css">-				 ' . $cubewp_css . '-				</style>';+			  if ( ! empty( $cubewp_css ) ) {+				  // Attach custom CSS inline to a known handle to avoid raw echo.+				  wp_add_inline_style( 'cwp-styles', $cubewp_css );+			  } 		   } ); 	 		   add_action( 'wp_footer', function(){@@ -369,9 +375,10 @@ 			  $cwpOptions = ! empty( $cwpOptions ) && is_array( $cwpOptions ) ? $cwpOptions : get_option( 'cwpOptions' ); 			  $cubewp_js = isset( $cwpOptions['cubewp-js'] ) && ! empty( $cwpOptions['cubewp-js'] ) ? $cwpOptions['cubewp-js'] : ''; 			  wp_enqueue_script( 'jquery' );-			  echo '<script type="text/javascript">-				 ' . $cubewp_js . '-				</script>';+			  if ( ! empty( $cubewp_js ) ) {+				  // Attach custom JS inline to jQuery handle to avoid raw echo.+				  wp_add_inline_script( 'jquery', $cubewp_js );+			  } 		   } ); 		} 	}

Vulnerability Existed: yes
TRUE POSITIVE
[Cross-Site Scripting (XSS)] - [CWE-79] - [cube/classes/class-cubewp-enqueue.php] [Lines 83-86]
[Old Code]
echo apply_filters( 'frontend/script/enqueue', '' );

[Fixed Code]
$cubewp_front_inline = apply_filters( 'frontend/script/enqueue', '' );
if ( ! empty( $cubewp_front_inline ) ) {
    echo wp_kses_post( $cubewp_front_inline );
}

Explanation:
The original code directly echoed the output of an apply_filters() call without any sanitization. While filters can be used to modify content, untrusted data passed through filters could contain malicious JavaScript. The fix stores the filtered output in a variable, checks if it's non-empty, and then outputs it using wp_kses_post(), which sanitizes the content to prevent XSS attacks by stripping dangerous HTML and JavaScript tags.

---

Vulnerability Existed: yes
TRUE POSITIVE
[Cross-Site Scripting (XSS)] - [CWE-79] - [cube/classes/class-cubewp-enqueue.php] [Lines 362-365]
[Old Code]
echo '<style type="text/css">
   ' . $cubewp_css . '
</style>';

[Fixed Code]
if ( ! empty( $cubewp_css ) ) {
    // Attach custom CSS inline to a known handle to avoid raw echo.
    wp_add_inline_style( 'cwp-styles', $cubewp_css );
}

Explanation:
The original code directly echoed CSS content retrieved from the database ($cubewp_css) without sanitization. While this is stored user/admin data, concatenating it directly into a style tag without proper escaping or validation could allow CSS injection attacks. The fix uses WordPress's wp_add_inline_style() function, which properly handles inline CSS attachment to registered stylesheets, providing better encapsulation and reducing injection vectors.

---

Vulnerability Existed: yes
TRUE POSITIVE
[Cross-Site Scripting (XSS)] - [CWE-79] - [cube/classes/class-cubewp-enqueue.php] [Lines 372-375]
[Old Code]
echo '<script type="text/javascript">
   ' . $cubewp_js . '
</script>';

[Fixed Code]
if ( ! empty( $cubewp_js ) ) {
    // Attach custom JS inline to jQuery handle to avoid raw echo.
    wp_add_inline_script( 'jquery', $cubewp_js );
}

Explanation:
The original code directly echoed JavaScript content from the database without sanitization. This is a high-risk vulnerability as arbitrary JavaScript can be executed in user browsers, leading to complete compromise. The fix uses WordPress's wp_add_inline_script() function, which properly enqueues inline scripts with proper context management and reduces the attack surface compared to raw echo statements.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-export.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-export.php	2026-01-18 00:20:56.197777850 +0000@@ -67,7 +67,7 @@         <form class="export-form" method="post" action="">             <input type="hidden" name="action" value="cwp_export_data">             <input type="hidden" name="cwp_export_type" value="all">-            <input type="hidden" name="cwp_export_nonce" value="<?php echo wp_create_nonce( 'cwp_export_data_nonce' ); ?>">+            <input type="hidden" name="cwp_export_nonce" value="<?php echo esc_attr( wp_create_nonce( 'cwp_export_data_nonce' ) ); ?>">             <div class="cubewp-import-box-container">                 <div class="cubewp-import-box">                     <div class="cubewp-import-card">@@ -207,15 +207,15 @@             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('You do not have permission to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce') ) {+        if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce') ) {             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        if(isset($_POST['export']) && $_POST['export'] == 'success'){+        if(isset($_POST['export']) && sanitize_text_field(wp_unslash($_POST['export'])) == 'success'){             $buffer = self::cwp_custom_fields_posts('cwp_user_fields');             $files = self::cwp_file_names();             if (self::cwp_file_force_contents($files['cwp_user_groups'], $buffer)) {-                $download_now = isset( $_POST['download_now'] ) ? sanitize_text_field( $_POST['download_now'] ) : 'true';+                $download_now = isset( $_POST['download_now'] ) ? sanitize_text_field( wp_unslash( $_POST['download_now'] ) ) : 'true';                 if ( $download_now != 'false' ) {                     self::cwp_create_zip_file();                 }@@ -238,11 +238,11 @@             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('You do not have permission to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce') ) {+        if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce') ) {             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        if(isset($_POST['export']) && $_POST['export'] == 'success'){+        if(isset($_POST['export']) && sanitize_text_field(wp_unslash($_POST['export'])) == 'success'){             $buffer = self::cwp_custom_fields_posts('cwp_forms');             $files = self::cwp_file_names();             if (self::cwp_file_force_contents($files['cwp_custom_forms'], $buffer)) {@@ -272,7 +272,7 @@             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('You do not have permission to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        if ( !isset($_POST['cwp_export_nonce']) || !wp_verify_nonce($_POST['cwp_export_nonce'], 'cwp_export_data_nonce') ) {+        if ( !isset($_POST['cwp_export_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['cwp_export_nonce'])), 'cwp_export_data_nonce') ) {             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework') ) );             wp_die();         }@@ -285,6 +285,7 @@ 				)); 			} else { 				$export_content = array();+                /* phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized */ 				foreach ($_POST['cwp_export_content_type'] as $content_type) { 					switch ($content_type) { 						case 'post_types':@@ -398,11 +399,11 @@         $post_cards_dir = $upload_dir['basedir'] . '/cubewp-post-cards';          if (!is_dir($export_path)) {-            mkdir($export_path, 0755, true); // Ensure export directory exists+            wp_mkdir_p( $export_path );         }          if (file_exists($export_path . $DelFilePath)) {-            unlink($export_path . $DelFilePath);+            wp_delete_file($export_path . $DelFilePath);         }          if ($zip->open($export_path . $DelFilePath, ZIPARCHIVE::CREATE) !== TRUE) {@@ -414,8 +415,8 @@         $zip->addFile($files['cwp_post_groups'], 'cwp_post_groups.json');         $zip->addFile($files['cwp_user_groups'], 'cwp_user_groups.json');         $zip->addFile($files['cwp_custom_forms'], 'cwp_custom_forms.json');--        $export_post_cards = isset($_POST['export_post_cards']) ? sanitize_text_field($_POST['export_post_cards']) : 'false';+        /*phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing */+        $export_post_cards = isset($_POST['export_post_cards']) ? sanitize_text_field(wp_unslash($_POST['export_post_cards'])) : 'false';         // Add "cubewp-post-cards" to the zip archive         if ($export_post_cards == 'true' && is_dir($post_cards_dir)) {             $this->add_post_cards_folder_to_zip($post_cards_dir, $zip, 'cubewp-post-cards');@@ -425,10 +426,10 @@         $zip->close();          // Cleanup temporary files-        unlink($files['setup_file']);-        unlink($files['cwp_post_groups']);-        unlink($files['cwp_user_groups']);-        unlink($files['cwp_custom_forms']);+        wp_delete_file($files['setup_file']);+        wp_delete_file($files['cwp_post_groups']);+        wp_delete_file($files['cwp_user_groups']);+        wp_delete_file($files['cwp_custom_forms']);     }      /**@@ -464,11 +465,11 @@      * Method cwp_file_force_contents      *      * @param string $file_path-     * @param Json $file_content-     * @param bolean $flags+     * @param string $file_content+     * @param int $flags      * @param int $permissions      *-     * @return Json+     * @return boolean 	 * @since  1.0.0      */     private static function cwp_file_force_contents($file_path, $file_content, $flags = 0, $permissions = 0777) {@@ -476,8 +477,9 @@ 		array_pop($parts); 		$dir = implode('/', $parts); -		if ( ! is_dir($dir)) {-			mkdir($dir, $permissions, true);+		if ( ! is_dir( $dir ) ) {+			// Use WordPress API to create directories recursively.+			wp_mkdir_p( $dir ); 		}  		return file_put_contents($file_path, $file_content, $flags);

Let me analyze the provided diff directly as requested.

## Security Analysis of class-cubewp-export.php Diff

---

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - class-cubewp-export.php (Line 70)
Old Code:
```php
<input type="hidden" name="cwp_export_nonce" value="<?php echo wp_create_nonce( 'cwp_export_data_nonce' ); ?>">
```
Fixed Code:
```php
<input type="hidden" name="cwp_export_nonce" value="<?php echo esc_attr( wp_create_nonce( 'cwp_export_data_nonce' ) ); ?>">
```
Explanation:
The nonce value was output directly into an HTML attribute without escaping. Although `wp_create_nonce()` returns a sanitized string, it's a security best practice to escape output based on context. In HTML attributes, `esc_attr()` should be used to prevent attribute-based XSS attacks. This fix properly escapes the nonce value for its HTML attribute context.

---

**Vulnerability 2:**

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 210)
Old Code:
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce') ) {
```
Fixed Code:
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce') ) {
```
Explanation:
`$_POST` superglobal data should be sanitized and unslashed before use. While `wp_verify_nonce()` internally handles the data, passing raw `$_POST` values is poor practice. The fix applies `wp_unslash()` to remove WordPress magic quotes, then `sanitize_text_field()` to sanitize the nonce string before verification, following WordPress security standards.

---

**Vulnerability 3:**

Vulnerability Existed: yes
TRUE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 214)
Old Code:
```php
if(isset($_POST['export']) && $_POST['export'] == 'success'){
```
Fixed Code:
```php
if(isset($_POST['export']) && sanitize_text_field(wp_unslash($_POST['export'])) == 'success'){
```
Explanation:
Direct use of `$_POST['export']` without sanitization creates an input validation vulnerability. An attacker could potentially exploit this by sending specially crafted data. The fix sanitizes the input using `wp_unslash()` and `sanitize_text_field()` to ensure it's safe before comparison.

---

**Vulnerability 4:**

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 217)
Old Code:
```php
$download_now = isset( $_POST['download_now'] ) ? sanitize_text_field( $_POST['download_now'] ) : 'true';
```
Fixed Code:
```php
$download_now = isset( $_POST['download_now'] ) ? sanitize_text_field( wp_unslash( $_POST['download_now'] ) ) : 'true';
```
Explanation:
The original code sanitized the input but failed to unslash it first. In WordPress, `wp_unslash()` must be applied before sanitization to properly handle magic quotes. This is a minor but important security practice—unslashing should precede sanitization to ensure proper handling of escaped data.

---

**Vulnerability 5:**

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 241)
Old Code:
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce') ) {
```
Fixed Code:
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce') ) {
```
Explanation:
Same as Vulnerability 2. Raw `$_POST['nonce']` should be unslashed and sanitized before use, even in nonce verification functions. This fix ensures proper handling of superglobal data.

---

**Vulnerability 6:**

Vulnerability Existed: yes
TRUE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 245)
Old Code:
```php
if(isset($_POST['export']) && $_POST['export'] == 'success'){
```
Fixed Code:
```php
if(isset($_POST['export']) && sanitize_text_field(wp_unslash($_POST['export'])) == 'success'){
```
Explanation:
Same as Vulnerability 3. Direct use of unsanitized `$_POST` data without proper validation.

---

**Vulnerability 7:**

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 275)
Old Code:
```php
if ( !isset($_POST['cwp_export_nonce']) || !wp_verify_nonce($_POST['cwp_export_nonce'], 'cwp_export_data_nonce') ) {
```
Fixed Code:
```php
if ( !isset($_POST['cwp_export_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['cwp_export_nonce'])), 'cwp_export_data_nonce') ) {
```
Explanation:
Same as Vulnerabilities 2 and 5. Raw nonce from `$_POST` should be unslashed and sanitized before passing to verification function.

---

**Vulnerability 8:**

Vulnerability Existed: yes
TRUE POSITIVE
Insecure File Operations - CWE-377 - class-cubewp-export.php (Line 401)
Old Code:
```php
mkdir($export_path, 0755, true); // Ensure export directory exists
```
Fixed Code:
```php
wp_mkdir_p( $export_path );
```
Explanation:
Using native `mkdir()` instead of WordPress API function `wp_mkdir_p()` is problematic. The WordPress function properly handles permissions and integrates with WordPress security standards. Using native file operations bypasses WordPress security checks and may cause permission issues on some hosting environments.

---

**Vulnerability 9:**

Vulnerability Existed: yes
FALSE POSITIVE
Insecure File Operations - CWE-377 - class-cubewp-export.php (Line 406)
Old Code:
```php
unlink($export_path . $DelFilePath);
```
Fixed Code:
```php
wp_delete_file($export_path . $DelFilePath);
```
Explanation:
Using native `unlink()` instead of WordPress API function `wp_delete_file()` bypasses WordPress security checks. The WordPress function properly handles file deletion within the WordPress security context and is the recommended approach.

---

**Vulnerability 10:**

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-export.php (Line 419)
Old Code:
```php
$export_post_cards = isset($_POST['export_post_cards']) ? sanitize_text_field($_POST['export_post_cards']) : 'false';
```
Fixed Code:
```php
$export_post_cards = isset($_POST['export_post_cards']) ? sanitize_text_field(wp_unslash($_POST['export_post_cards'])) : 'false';
```
Explanation:
Same as Vulnerability 4. The `wp_unslash()` call must precede `sanitize_text_field()` to properly handle WordPress magic quotes before sanitization.

---

**Vulnerability 11:**

Vulnerability Existed: yes
TRUE POSITIVE
Insecure File Operations - CWE-377 - class-cubewp-export.php (Lines 429-432)
Old Code:
```php
unlink($files['setup_file']);
unlink($files['cwp_post_groups']);
unlink($files['cwp_user_groups']);
unlink($files['cwp_custom_forms']);
```
Fixed Code:
```php
wp_delete_file($files['setup_file']);
wp_delete_file($files['cwp_post_groups']);
wp_delete_file($files['cwp_user_groups']);
wp_delete_file($files['cwp_custom_forms']);
```
Explanation:
Same as Vulnerability 9. Multiple instances of native `unlink()` replaced with WordPress API `wp_delete_file()` for proper security handling and consistency with WordPress standards.

---

**Vulnerability 12:**

Vulnerability Existed: yes
FALSE POSITIVE
Insecure File Operations - CWE-377 - class-cubewp-export.php (Line 480)
Old Code:
```php
if ( ! is_dir($dir)) {
	mkdir($dir, $permissions, true);
}
```
Fixed Code:
```php
if ( ! is_dir( $dir ) ) {
	// Use WordPress API to create directories recursively.
	wp_mkdir_p( $dir );
}
```
Explanation:
Same as Vulnerability 8. Native `mkdir()` replaced with WordPress API `wp_mkdir_p()`. Additionally, the permission parameter is removed since `wp_mkdir_p()` handles permissions internally using WordPress standards.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-form-builder.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-form-builder.php	2026-01-18 00:20:56.197777850 +0000@@ -30,17 +30,25 @@             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('You do not have permission to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        $form_relation = isset( $_POST['form_relation'] ) ? sanitize_text_field( $_POST['form_relation'] ) : '';-        $form_type     = isset( $_POST['form_type'] ) ? sanitize_text_field( $_POST['form_type'] ) : '';+        // phpcs:ignore WordPress.Security.NonceVerification.Missing+        $form_relation = isset( $_POST['form_relation'] ) ? sanitize_text_field( wp_unslash( $_POST['form_relation'] ) ) : '';+        // phpcs:ignore WordPress.Security.NonceVerification.Missing+        $form_type     = isset( $_POST['form_type'] ) ? sanitize_text_field( wp_unslash( $_POST['form_type'] ) ) : '';         if ( $form_type != '' ) {             $cwp_forms = CWP()->get_form( $form_type );             if ( isset( $form_relation ) && ! empty( $form_relation ) ) {+                // phpcs:ignore WordPress.Security.NonceVerification.Missing                 if ( isset( $_POST['cwpform'] ) && ! empty( $_POST['cwpform'] ) ) {                                          if ( $form_type == 'loop_builder' ) {+                        /*phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing */                         $cwp_forms[ $form_relation ] = apply_filters( 'cubewp/loop/builder/save', array() , $_POST['cwpform'], $form_relation );                     }else {-                        $cwp_forms[ $form_relation ] = CubeWp_Sanitize_Dynamic_Array( $_POST['cwpform'][ $form_relation ] );+                        // phpcs:ignore WordPress.Security.NonceVerification.Missing+                        if(isset($_POST['cwpform'][ $form_relation ])){+                            /*phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing */+                            $cwp_forms[ $form_relation ] = CubeWp_Sanitize_Dynamic_Array( $_POST['cwpform'][ $form_relation ] );+                        }                     }                      CWP()->update_form( $form_type, $cwp_forms );@@ -66,10 +74,12 @@             wp_die();         }         $section_args = [];+        // phpcs:ignore WordPress.Security.NonceVerification.Missing         if(isset($_POST['action'])){-            unset($_POST['action']);-            unset($_POST['section_id']);+            unset($_POST['action']);// phpcs:ignore WordPress.Security.NonceVerification.Missing+            unset($_POST['section_id']);// phpcs:ignore WordPress.Security.NonceVerification.Missing         }+        // phpcs:ignore WordPress.Security.NonceVerification.Missing         if(isset($_POST['form_relation']) && isset($_POST['form_type'])){             foreach($_POST as $key => $POST){                 $section_args[$key] = $POST;@@ -91,7 +101,7 @@      */     public function cwpform_form_section( $args = array() ) {         $defaults         = array(-            'section_id'          => rand( 123456789, 111111111 ),+            'section_id'          => wp_rand( 123456789, 111111111 ),             'section_title'       => '',             'section_description' => '',             'section_type'        => '',@@ -449,9 +459,9 @@                 'name'        => 'display_ui',                 'value'       => $appearance,                 'options'     => array(-                    'select'       => __( "Dropdown" ),-                    'multi_select' => __( "Multi Dropdown" ),-                    'checkbox'     => __( "checkbox" )+                    'select'       => __( "Dropdown", "cubewp-framework" ),+                    'multi_select' => __( "Multi Dropdown", "cubewp-framework" ),+                    'checkbox'     => __( "checkbox", "cubewp-framework" )                 ),                 'extra_attrs' => 'data-name="display_ui"',             );@@ -463,7 +473,7 @@                 'class'       => 'group-field field-select2_ui',                 'name'        => 'select2_ui',                 'value'       => isset( $field['select2_ui'] ) && ! empty( $field['select2_ui'] ) ? $field['select2_ui'] : '0',-                'options'     => array( '0' => __( "No" ), '1' => __( "Yes" ) ),+                'options'     => array( '0' => __( "No", "cubewp-framework" ), '1' => __( "Yes", "cubewp-framework" ) ),                 'extra_attrs' => 'data-name="select2_ui"',             );             $output      .= cwp_render_dropdown_input( $input_attrs );@@ -485,7 +495,7 @@                 'class'       => 'group-field field-select2_ui',                 'name'        => 'select2_ui',                 'value'       => isset( $field['select2_ui'] ) && ! empty( $field['select2_ui'] ) ? $field['select2_ui'] : '0',-                'options'     => array( '0' => __( "No" ), '1' => __( "Yes" ) ),+                'options'     => array( '0' => __( "No", "cubewp-framework" ), '1' => __( "Yes", "cubewp-framework" ) ),                 'extra_attrs' => 'data-name="select2_ui"',             );             $output      .= cwp_render_dropdown_input( $input_attrs );@@ -559,7 +569,7 @@                 'class'       => 'group-field field-required',                 'name'        => 'required',                 'value'       => isset( $field['required'] ) ? $field['required'] : $default_required,-                'options'     => array( '1' => __( "Required" ), '0' => __( "Not required" ) ),+                'options'     => array( '1' => __( "Required", "cubewp-framework" ), '0' => __( "Not required", "cubewp-framework" ) ),                 'extra_attrs' => 'data-name="required"',             );             $output      .= cwp_render_dropdown_input( $input_attrs );@@ -597,7 +607,7 @@                 'class'       => 'group-field field-sorting',                 'name'        => 'sorting',                 'value'       => isset( $field['sorting'] ) && ! empty( $field['sorting'] ) ? $field['sorting'] : '',-                'options'     => array( '1' => __( "Yes" ), '0' => __( "No" ) ),+                'options'     => array( '1' => __( "Yes", "cubewp-framework" ), '0' => __( "No", "cubewp-framework" ) ),                 'extra_attrs' => 'data-name="sorting"',             );             $output      .= cwp_render_dropdown_input( $input_attrs );@@ -774,7 +784,7 @@                         if(!empty($fields)){                             foreach($fields as $input_attr){                                 if($input_attr['type'] == 'hidden'){-                                    echo call_user_func('cwp_render_hidden_input',$input_attr);+                                    echo call_user_func('cwp_render_hidden_input', $input_attr); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped                                 }else{                                     $field_type = $input_attr['type'];                                     if(isset($input_attr['input_type']) && !empty($input_attr['input_type'])){@@ -783,9 +793,9 @@                                     ?>                                     <div class="section-form-field">                                         <?php if(isset($input_attr['label']) && !empty($input_attr['label'])){ ?>-                                        <label for="section_class"><?php echo $input_attr['label']; ?></label>+                                        <label for="section_class"><?php echo esc_html( $input_attr['label'] ); ?></label>                                         <?php } ?>-                                        <?php echo call_user_func('cwp_render_'.$field_type.'_input',$input_attr); ?>+                                        <?php echo call_user_func( 'cwp_render_'.$field_type.'_input', $input_attr ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>                                     </div>                                     <?php                                 }

Error: Claude CLI returned empty response

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-forms-pro.php	2026-01-18 00:20:47.469235541 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-forms-pro.php	2026-01-18 00:20:56.197777850 +0000@@ -31,14 +31,14 @@ 		$page_header="CubeWP Forms"; 		$background_image_src = CWP_PLUGIN_URI.'cube/assets/admin/images/forms-templates.png'; 		echo'<div id="cubewp-title-bar">-			<h1>'.$page_header.'</h1>+			<h1>'.esc_html($page_header).'</h1> 		</div> 		<div class="cubewp-subscription-frame forms-templates" style="background:#f0f0f1 0% 0% no-repeat padding-box;">-			<img class="cubewp-subscription-frame-bg" src="'.$background_image_src.'" alt="">+			<img class="cubewp-subscription-frame-bg" src="'.esc_url($background_image_src).'" alt=""> 			<div class="cubewp-subscription-main"> 				<div class="cubewp-subscription-form"> 					<div class="cube-subscription-header forms-templates">-						<img class="subscription-header-super" src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/forms.svg" alt="image">+						<img class="subscription-header-super" src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/forms.svg').'" alt="image"> 					</div> 					<div class="cubewp-subscription-contant forms-templates"> 						<div class="cubewp-subscription-logo">

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-forms-pro.php Lines 34, 37, 41

Old Code:
```php
<h1>'.$page_header.'</h1>
<img class="cubewp-subscription-frame-bg" src="'.$background_image_src.'" alt="">
<img class="subscription-header-super" src="'.CWP_PLUGIN_URI.'cube/assets/admin/images/forms.svg" alt="image">
```

Fixed Code:
```php
<h1>'.esc_html($page_header).'</h1>
<img class="cubewp-subscription-frame-bg" src="'.esc_url($background_image_src).'" alt="">
<img class="subscription-header-super" src="'.esc_url(CWP_PLUGIN_URI.'cube/assets/admin/images/forms.svg').'" alt="image">
```

Explanation:
The original code directly echoed user-controlled or plugin-controlled values into HTML attributes without proper escaping. The `$page_header` variable was output directly into an HTML heading tag, creating an XSS vulnerability if the variable could be influenced by user input. The `$background_image_src` and `CWP_PLUGIN_URI` constants were used in URL attributes without URL escaping, which could allow malicious URLs or javascript: protocol handlers to be injected. The fix properly applies `esc_html()` for HTML context and `esc_url()` for URL context, which are WordPress security functions that prevent XSS attacks by escaping special characters appropriately for their respective contexts.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-frontend-alerts.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-frontend-alerts.php	2026-01-18 00:20:56.197777850 +0000@@ -68,7 +68,10 @@                             <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" fill="currentColor"  viewBox="0 0 16 16">                               <path d="M12.854.146a.5.5 0 0 0-.707 0L10.5 1.793 14.207 5.5l1.647-1.646a.5.5 0 0 0 0-.708l-3-3zm.646 6.061L9.793 2.5 3.293 9H3.5a.5.5 0 0 1 .5.5v.5h.5a.5.5 0 0 1 .5.5v.5h.5a.5.5 0 0 1 .5.5v.5h.5a.5.5 0 0 1 .5.5v.207l6.5-6.5zm-7.468 7.468A.5.5 0 0 1 6 13.5V13h-.5a.5.5 0 0 1-.5-.5V12h-.5a.5.5 0 0 1-.5-.5V11h-.5a.5.5 0 0 1-.5-.5V10h-.5a.499.499 0 0 1-.175-.032l-.179.178a.5.5 0 0 0-.11.168l-2 5a.5.5 0 0 0 .65.65l5-2a.5.5 0 0 0 .168-.11l.178-.178z"/>                             </svg>-                            <?php echo sprintf(esc_html__('Edit this %s', 'cubewp-framework'), get_post_type_object( $post_type )->labels->singular_name) ?>+                            <?php+                            /* translators: %s: post type singular name. */+                            echo sprintf( esc_html__( 'Edit this %s', 'cubewp-framework' ), esc_html( get_post_type_object( $post_type )->labels->singular_name ) );+                            ?>                         </button>                     </a>                 <?php } ?>@@ -104,8 +107,10 @@          public function cubewp_get_notification_msg(){         $free_msg =  true;+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.         if(isset($_GET['p']) && isset($_GET['post_type']) && !is_admin()) {-            $post_id   =   wp_kses_post($_GET['p']);+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+            $post_id   =   wp_kses_post(wp_unslash($_GET['p']));             $plan_id   =   get_post_meta($post_id, 'plan_id', true);             if( $plan_id > 0 ) {                 $plan_price =   get_post_meta($plan_id, 'plan_price', true);@@ -115,9 +120,11 @@             }         }         if( $free_msg ){-            return sprintf(__('Your %s is pending for review.', 'cubewp-framework'), get_post_type_object( get_post_type($post_id) )->labels->singular_name);+            /* translators: %s: post type singular name. */+            return sprintf( __('Your %s is pending for review.', 'cubewp-framework'), get_post_type_object( get_post_type($post_id) )->labels->singular_name );         }else{-            return sprintf(__('Your %s is pending! Please proceed to make it published', 'cubewp-framework'), get_post_type_object( get_post_type($post_id) )->labels->singular_name);+            /* translators: %s: post type singular name. */+            return sprintf( __('Your %s is pending! Please proceed to make it published', 'cubewp-framework'), get_post_type_object( get_post_type($post_id) )->labels->singular_name );         }              }

# Security Analysis Report

## Vulnerability 1

**Vulnerability Existed:** yes

**Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-frontend-alerts.php - Line 71**

**Old Code:**
```php
<?php echo sprintf(esc_html__('Edit this %s', 'cubewp-framework'), get_post_type_object( $post_type )->labels->singular_name) ?>
```

**Fixed Code:**
```php
<?php
/* translators: %s: post type singular name. */
echo sprintf( esc_html__( 'Edit this %s', 'cubewp-framework' ), esc_html( get_post_type_object( $post_type )->labels->singular_name ) );
?>
```

**Explanation:**
The old code was vulnerable to stored XSS. While `esc_html__()` escapes the translatable string, the `get_post_type_object( $post_type )->labels->singular_name` value was passed directly without escaping. Post type object labels can potentially contain unescaped HTML/JavaScript if the post type was registered with malicious content in the label parameter. The fix wraps this value with `esc_html()` to ensure all output is properly escaped before display.

---

## Vulnerability 2

**Vulnerability Existed:** yes

**Improper Input Validation / Use of Unescaped GET Parameter - CWE-20 - cube/classes/class-cubewp-frontend-alerts.php - Line 112**

**Old Code:**
```php
$post_id   =   wp_kses_post($_GET['p']);
```

**Fixed Code:**
```php
$post_id   =   wp_kses_post(wp_unslash($_GET['p']));
```

**Explanation:**
The old code failed to properly sanitize the `$_GET['p']` parameter. While `wp_kses_post()` removes potentially dangerous HTML/JavaScript, it doesn't handle WordPress's magic quotes behavior. The `$_GET` variable may contain slashes added by WordPress's legacy magic quotes system. Using `wp_unslash()` before `wp_kses_post()` ensures that any escaped quotes are properly unslashed before sanitization, preventing potential bypass of the sanitization and ensuring the post ID is correctly processed. Additionally, proper PHPCS annotations acknowledge the security implications of reading unsanitized GET parameters and document that this is for read-only operations.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-frontend-templates.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-frontend-templates.php	2026-01-18 00:20:56.197777850 +0000@@ -1,5 +1,4 @@ <?php- /**  * CubeWp Frontend templates is for display of single post and archive templates  *@@ -7,6 +6,8 @@  * @package cubewp/cube/classes  */ + // phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ if ( ! defined( 'ABSPATH' ) ) { 	exit; }@@ -86,7 +87,7 @@                     $hook = get_post_meta( $template_id, 'template_location', true );                     $content_to_echo = CubeWp_Theme_Builder::do_cubewp_theme_builder('block', $template_id, true);                     add_action( $hook, function() use ( $content_to_echo ) {-                        echo $content_to_echo;+                        echo wp_kses_post($content_to_echo);                     });                 }             }@@ -351,9 +352,11 @@                 'author.php'             );         }elseif (is_search()) {+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.             if ( isset( $_GET['post_type'] ) && !empty( $_GET['post_type'] ) ) {                 // Sanitize the post_type value from the query string-                $post_type = sanitize_text_field( $_GET['post_type'] );+                // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+                $post_type = sanitize_text_field( wp_unslash($_GET['post_type']) );                                  // Define the template array                 $templates = array(

Based on my analysis of the code diff, here are the security fixes:

---

**Vulnerability 1: Cross-Site Scripting (XSS) - Stored**

Vulnerability Existed: yes
TRUE POSITIVE

Improper Neutralization of Input During Web Page Generation - CWE-79 - cube/classes/class-cubewp-frontend-templates.php - Lines 89-90

Old Code:
```php
add_action( $hook, function() use ( $content_to_echo ) {
    echo $content_to_echo;
});
```

Fixed Code:
```php
add_action( $hook, function() use ( $content_to_echo ) {
    echo wp_kses_post($content_to_echo);
});
```

Explanation:
The old code directly echoed `$content_to_echo` without sanitization. Although this data comes from `CubeWp_Theme_Builder::do_cubewp_theme_builder()`, outputting any HTML/content without proper escaping can lead to XSS attacks. The fix applies `wp_kses_post()` which sanitizes the content to allow only safe HTML tags (like those used in posts), preventing malicious scripts from being executed in the browser.

---

**Vulnerability 2: Unsafe Deserialization of Untrusted Input**

Vulnerability Existed: yes
TRUE POSITIVE

Improper Neutralization of Special Elements used in an SQL Command - CWE-89 - cube/classes/class-cubewp-frontend-templates.php - Lines 356-359

Old Code:
```php
if ( isset( $_GET['post_type'] ) && !empty( $_GET['post_type'] ) ) {
    // Sanitize the post_type value from the query string
    $post_type = sanitize_text_field( $_GET['post_type'] );
```

Fixed Code:
```php
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.
if ( isset( $_GET['post_type'] ) && !empty( $_GET['post_type'] ) ) {
    // Sanitize the post_type value from the query string
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.
    $post_type = sanitize_text_field( wp_unslash($_GET['post_type']) );
```

Explanation:
The old code failed to properly handle magic quotes before sanitization. In PHP, `$_GET` values may have slashes added by magic quotes (in older PHP versions) or by external systems. The fix applies `wp_unslash()` before `sanitize_text_field()` to remove any extraneous slashes, ensuring proper sanitization. Additionally, PHPCS comments document the intentional security exception for read-only operations that don't modify state.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-frontend.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-frontend.php	2026-01-18 00:20:56.197777850 +0000@@ -421,6 +421,7 @@             </div>         </div>'; +        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped         echo apply_filters('cubewp/frontend/archive/list/switcher', $output);     }         @@ -449,11 +450,13 @@             'class'        => 'cwp-orderby',             'id'           => 'cwp-sorting-filter',             'name'         => 'cwp_orderby',-            'value'        => isset($_GET['orderby']) && !empty($_GET['orderby']) ? sanitize_text_field($_GET['orderby']) : 'DESC',+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+            'value'        => isset($_GET['orderby']) && !empty($_GET['orderby']) ? sanitize_text_field(wp_unslash($_GET['orderby'])) : 'DESC',             'options'      => $option,             'extra_attrs'  => '',             'placeholder'  => esc_html__('Sort By','cubewp-framework')         );+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped         echo cwp_render_dropdown_input( $input_attrs );     } 

Analyzing the security-related code diff from the CubeWP framework...

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE
[CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')] - [CWE-78] - cube/classes/class-cubewp-frontend.php [Line 454]
Old Code:
```php
'value'        => isset($_GET['orderby']) && !empty($_GET['orderby']) ? sanitize_text_field($_GET['orderby']) : 'DESC',
```
Fixed Code:
```php
'value'        => isset($_GET['orderby']) && !empty($_GET['orderby']) ? sanitize_text_field(wp_unslash($_GET['orderby'])) : 'DESC',
```
Explanation:
The vulnerability was the missing `wp_unslash()` call. When sanitizing user input from `$_GET`, the data may contain escaped slashes (backslashes) due to PHP's magic quotes legacy behavior or WordPress's input handling. Without `wp_unslash()`, `sanitize_text_field()` would process the already-escaped data, potentially leaving dangerous characters intact or causing improper sanitization. The fix properly unslashes the input before sanitization, ensuring that the data is correctly processed and safe for use.

---

**Vulnerability 2:**

Vulnerability Existed: yes
FALSE POSITIVE
[CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] - [CWE-79] - cube/classes/class-cubewp-frontend.php [Line 425]
Old Code:
```php
echo apply_filters('cubewp/frontend/archive/list/switcher', $output);
```
Fixed Code:
```php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters('cubewp/frontend/archive/list/switcher', $output);
```
Explanation:
The vulnerability exists because the output from `apply_filters()` is echoed directly without escaping. While the `phpcs:ignore` comment suppresses the WPCS warning, it doesn't actually fix the vulnerability—it just tells the code checker to ignore it. The filter could return unescaped user data or malicious content from plugins, creating an XSS vulnerability. A proper fix would be to escape the output (e.g., `echo wp_kses_post(apply_filters(...))`) rather than merely suppressing the warning.

---

**Vulnerability 3:**

Vulnerability Existed: not sure
[CWE-347: Improper Verification of Cryptographic Signature] - [CWE-347] - cube/classes/class-cubewp-frontend.php [Line 451]
Old Code:
```php
'value'        => isset($_GET['orderby']) && !empty($_GET['orderby']) ? sanitize_text_field($_GET['orderby']) : 'DESC',
```
Fixed Code:
```php
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.
'value'        => isset($_GET['orderby']) && !empty($_GET['orderby']) ? sanitize_text_field(wp_unslash($_GET['orderby'])) : 'DESC',
```
Explanation:
The code accesses `$_GET` without nonce verification. While the comment claims this is a "read-only use," directly reading and displaying user-controlled query parameters without nonce verification can still be problematic. A nonce ensures the request came from a legitimate source. The suppression comment suggests the developers believe the risk is acceptable, but technically this violates WordPress security best practices. Without nonce verification, the application is vulnerable to Cross-Site Request Forgery (CSRF) attacks if the sorting parameter triggers state changes or if an attacker can manipulate sorting behavior through CSRF.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-import.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-import.php	2026-01-18 00:20:56.201778099 +0000@@ -1,5 +1,4 @@ <?php- /**  * CubeWp Import to import only cubewp related data.  *@@ -7,6 +6,8 @@  * @package cubewp/cube/classes  */ +// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ if (! defined('ABSPATH')) {     exit; }@@ -23,8 +24,10 @@         add_action('cubewp_import', array($this, 'manage_import'));         add_action('wp_ajax_cwp_import_data', array($this, 'cwp_import_data_callback'));         add_action('wp_ajax_cwp_import_dummy_data', array($this, 'cwp_import_dummy_data_callback'));-        if (isset($_GET['import']) && $_GET['import'] == 'success') {-            new CubeWp_Admin_Notice("cubewp-import-success", esc_html__('Data Imported Successfully', 'cubewp-framework'), 'success', false);+        $cwp_import_flag  = isset( $_GET['import'] ) ? sanitize_key( wp_unslash( $_GET['import'] ) ) : '';+        $cwp_import_nonce = isset( $_GET['security_nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['security_nonce'] ) ) : '';+        if ( 'success' === $cwp_import_flag && $cwp_import_nonce && wp_verify_nonce( $cwp_import_nonce, 'cwp_import_data_nonce' ) ) {+            new CubeWp_Admin_Notice( 'cubewp-import-success', esc_html__( 'Data Imported Successfully', 'cubewp-framework' ), 'success', false );         }     } @@ -46,8 +49,12 @@      */     public function manage_import()     {-        if (isset($_GET['import']) && $_GET['import'] == 'success' && isset($_SESSION['terms'])) {-            $this->cwp_import_terms(cubewp_core_data($_SESSION['terms']));+        $cwp_import_flag  = isset( $_GET['import'] ) ? sanitize_key( wp_unslash( $_GET['import'] ) ) : '';+        $cwp_import_nonce = isset( $_GET['security_nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['security_nonce'] ) ) : '';+        if ( 'success' === $cwp_import_flag && $cwp_import_nonce && wp_verify_nonce( $cwp_import_nonce, 'cwp_import_data_nonce' ) && isset( $_SESSION['terms'] ) ) {+            // The imported terms payload is sanitized inside cubewp_core_data().+            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized+            $this->cwp_import_terms( cubewp_core_data( $_SESSION['terms'] ) );             session_destroy();         } ?>@@ -61,7 +68,7 @@             </div>             <form id="import_form" method="post" action="" enctype="multipart/form-data">                 <input type="hidden" name="action" value="cwp_import_data">-                <input type="hidden" name="cwp_import_nonce" value="<?php echo wp_create_nonce('cwp_import_data_nonce'); ?>">+                <input type="hidden" name="cwp_import_nonce" value="<?php echo esc_attr(wp_create_nonce('cwp_import_data_nonce')); ?>">                 <div class="cubewp-import-box-container">                     <div class="cubewp-import-box">                         <div class="cubewp-import-card">@@ -92,7 +99,7 @@                             </div>                         </div>                         <button type="submit" class="button-primary cwp_import_demo" name="cwp_import">-                            <?php esc_html_e('Import', 'cubewp'); ?>+                            <?php esc_html_e('Import', 'cubewp-framework'); ?>                         </button>                     </div>                 </div>@@ -123,10 +130,11 @@             if (is_dir($file_path)) {                 $this->rmdir_recursive($file_path); // Recursive call             } else {-                unlink($file_path); // Delete file+                wp_delete_file($file_path); // Delete file             }         } +        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_rmdir         return rmdir($dir); // Remove directory and return result     }     /**@@ -141,7 +149,7 @@             // User doesn't have the required capabilities             wp_send_json(array('success' => 'false', 'msg' => esc_html__("You do not have permission to perform this action.", 'cubewp-framework')));         }-        if (isset($_FILES["file"]["name"]) && isset($_POST['cwp_import_nonce']) && wp_verify_nonce($_POST['cwp_import_nonce'], 'cwp_import_data_nonce')) {+        if (isset($_FILES["file"]["name"]) && isset($_POST['cwp_import_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['cwp_import_nonce'])), 'cwp_import_data_nonce')) {             $import_file = $_FILES;             $filename = sanitize_file_name($import_file["file"]["name"]);             $source = $import_file["file"]["tmp_name"];@@ -165,6 +173,7 @@             $upload_dir = wp_upload_dir();             $path  = $upload_dir['path'] . '/cubewp/import/';  // absolute path to the directory where zipper.php is in             if (! is_dir($path)) {+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir                 mkdir($path, 0777, true);             }             $filenoext = basename($filename, '.zip');  // absolute path to the directory where zipper.php is in (lowercase)@@ -178,17 +187,19 @@              if (is_dir($targetdir))  $this->rmdir_recursive($targetdir); +            // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir             mkdir($targetdir, 0777);              /* here it is really happening */ +            // phpcs:ignore Generic.PHP.ForbiddenFunctions.Found             if (move_uploaded_file($source, $targetzip)) {                 $zip = new ZipArchive();                 $x = $zip->open($targetzip);  // open the zip file to extract                 if ($x === true) {                     $zip->extractTo($targetdir); // place in the directory with same name                       $zip->close();-                    unlink($targetzip);+                    wp_delete_file($targetzip);                 }                 $moved = true;             } else {@@ -219,7 +230,7 @@                 }                 $message = !empty($message) ? $message : esc_html__('Data imported successfull.', 'cubewp-framework');                 $this->rmdir_recursive($targetdir);-                wp_send_json(array('success' => 'true', 'msg' => $message, 'redirectURL' => admin_url('admin.php?page=cubewp-import&import=success')));+                wp_send_json(array('success' => 'true', 'msg' => $message, 'redirectURL' => admin_url('admin.php?page=cubewp-import&import=success&security_nonce='.wp_create_nonce('cwp_import_data_nonce'))));             }              wp_die();@@ -240,7 +251,7 @@             wp_send_json(array('success' => 'false', 'msg' => esc_html__('You do not have permission to perform this action.', 'cubewp-framework')));             wp_die();         }-        if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce')) {+        if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce')) {             wp_send_json(array('success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework')));             wp_die();         }@@ -282,7 +293,7 @@             }             do_action('cwp_actions_after_demo_imported');             $message = !empty($message) ? $message : esc_html__('Dummy data imported successfully.', 'cubewp-framework');-            $redirectURL = apply_filters('cubewp/after/import/redirect', admin_url('admin.php?page=cubewp-import&import=success'));+            $redirectURL = apply_filters('cubewp/after/import/redirect', admin_url('admin.php?page=cubewp-import&import=success&security_nonce='.wp_create_nonce('cwp_import_data_nonce')));             $success = apply_filters('cubewp/after/import/success_message', '');             $successMessage = '';             if (is_array($success) && isset($success['selecter']) && isset($success['message'])) {@@ -298,7 +309,7 @@     /**      * Method cwp_import_dummy_content      *-     * @return void+     * @return mixed string or array      * @since  1.0.0      */     public function cwp_import_files($setup = false, $content = false)@@ -347,6 +358,7 @@     {         if (is_dir($source)) {             // Create destination directory if it doesn't exist+            // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir             @mkdir($destination);             $directory = dir($source);             while (false !== ($readdirectory = $directory->read())) {@@ -374,8 +386,9 @@         }         $files = array_diff(scandir($dir), array('.', '..'));         foreach ($files as $file) {-            (is_dir("$dir/$file")) ? $this->remove_directory("$dir/$file") : unlink("$dir/$file");+            (is_dir("$dir/$file")) ? $this->remove_directory("$dir/$file") : wp_delete_file("$dir/$file");         }+        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_rmdir         return rmdir($dir);     } @@ -458,7 +471,7 @@      *      * @param $targetdir $targetdir path of files      *-     * @return void+     * @return mixed string or array      */     public function cwp_import_wordpress_content($targetdir = '', $file = '')     {

I'll analyze the provided code diff for security fixes.

Vulnerability Existed: yes
TRUE POSITIVE
Improper Input Validation - CWE-20 - cube/classes/class-cubewp-import.php Lines 26-29
[Old Code]
if (isset($_GET['import']) && $_GET['import'] == 'success') {
    new CubeWp_Admin_Notice("cubewp-import-success", esc_html__('Data Imported Successfully', 'cubewp-framework'), 'success', false);
}

[Fixed Code]
$cwp_import_flag  = isset( $_GET['import'] ) ? sanitize_key( wp_unslash( $_GET['import'] ) ) : '';
$cwp_import_nonce = isset( $_GET['security_nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['security_nonce'] ) ) : '';
if ( 'success' === $cwp_import_flag && $cwp_import_nonce && wp_verify_nonce( $cwp_import_nonce, 'cwp_import_data_nonce' ) ) {
    new CubeWp_Admin_Notice( 'cubewp-import-success', esc_html__( 'Data Imported Successfully', 'cubewp-framework' ), 'success', false );
}

Explanation:
The old code directly accessed and compared $_GET['import'] without sanitization or nonce verification, creating a CSRF vulnerability. An attacker could craft a malicious link that would execute the success notice without proper authorization. The fix adds sanitization using sanitize_key() and wp_unslash(), introduces nonce verification via wp_verify_nonce(), and uses strict comparison (===) instead of loose comparison (==).

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - cube/classes/class-cubewp-import.php Lines 52-54
[Old Code]
if (isset($_GET['import']) && $_GET['import'] == 'success' && isset($_SESSION['terms'])) {
    $this->cwp_import_terms(cubewp_core_data($_SESSION['terms']));

[Fixed Code]
$cwp_import_flag  = isset( $_GET['import'] ) ? sanitize_key( wp_unslash( $_GET['import'] ) ) : '';
$cwp_import_nonce = isset( $_GET['security_nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['security_nonce'] ) ) : '';
if ( 'success' === $cwp_import_flag && $cwp_import_nonce && wp_verify_nonce( $cwp_import_nonce, 'cwp_import_data_nonce' ) && isset( $_SESSION['terms'] ) ) {

Explanation:
Same CSRF vulnerability as above. The code checked $_GET['import'] without nonce verification, allowing attackers to trigger unintended operations. The fix adds proper nonce verification using wp_verify_nonce() with a specific nonce token.

---

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-import.php Line 71
[Old Code]
<input type="hidden" name="cwp_import_nonce" value="<?php echo wp_create_nonce('cwp_import_data_nonce'); ?>">

[Fixed Code]
<input type="hidden" name="cwp_import_nonce" value="<?php echo esc_attr(wp_create_nonce('cwp_import_data_nonce')); ?>">

Explanation:
The nonce value was not escaped before output in an HTML attribute. While nonces are cryptographically safe, the output context (HTML attribute) requires proper escaping. The fix applies esc_attr() to ensure the value is safe for the HTML attribute context, preventing potential XSS if unexpected characters were present.

---

Vulnerability Existed: yes
TRUE POSITIVE
Insecure File Operations - CWE-434 - cube/classes/class-cubewp-import.php Lines 126 and 195
[Old Code]
unlink($file_path); // Delete file
...
unlink($targetzip);

[Fixed Code]
wp_delete_file($file_path); // Delete file
...
wp_delete_file($targetzip);

Explanation:
The code used PHP's native unlink() function instead of WordPress's wp_delete_file(). WordPress's wrapper function provides additional security considerations and logging capabilities. Additionally, the diff adds phpcs ignore comments for direct file system operations to acknowledge the security concern.

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Nonce Verification - CWE-352 - cube/classes/class-cubewp-import.php Line 152
[Old Code]
if (isset($_FILES["file"]["name"]) && isset($_POST['cwp_import_nonce']) && wp_verify_nonce($_POST['cwp_import_nonce'], 'cwp_import_data_nonce')) {

[Fixed Code]
if (isset($_FILES["file"]["name"]) && isset($_POST['cwp_import_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['cwp_import_nonce'])), 'cwp_import_data_nonce')) {

Explanation:
While wp_verify_nonce() is present, the nonce value itself was not sanitized before being passed to the verification function. The fix applies wp_unslash() and sanitize_text_field() to ensure the nonce is properly cleaned before verification, preventing potential issues from unsanitized POST data.

---

Vulnerability Existed: yes
TRUE POSITIVE
Missing Nonce Protection - CWE-352 - cube/classes/class-cubewp-import.php Line 233
[Old Code]
wp_send_json(array('success' => 'true', 'msg' => $message, 'redirectURL' => admin_url('admin.php?page=cubewp-import&import=success')));

[Fixed Code]
wp_send_json(array('success' => 'true', 'msg' => $message, 'redirectURL' => admin_url('admin.php?page=cubewp-import&import=success&security_nonce='.wp_create_nonce('cwp_import_data_nonce'))));

Explanation:
The redirect URL in the response did not include a nonce token. An attacker could intercept or predict the redirect URL and craft a CSRF attack. The fix adds a nonce parameter to the redirect URL, ensuring the subsequent page load can verify the request authenticity.

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Nonce Verification - CWE-352 - cube/classes/class-cubewp-import.php Line 254
[Old Code]
if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce')) {

[Fixed Code]
if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce')) {

Explanation:
Similar to the previous nonce issue, the nonce value was not sanitized before verification. The fix applies wp_unslash() and sanitize_text_field() to ensure proper handling of the POST parameter before nonce verification.

---

Vulnerability Existed: yes
TRUE POSITIVE
Missing Nonce Protection - CWE-352 - cube/classes/class-cubewp-import.php Line 296
[Old Code]
$redirectURL = apply_filters('cubewp/after/import/redirect', admin_url('admin.php?page=cubewp-import&import=success'));

[Fixed Code]
$redirectURL = apply_filters('cubewp/after/import/redirect', admin_url('admin.php?page=cubewp-import&import=success&security_nonce='.wp_create_nonce('cwp_import_data_nonce')));

Explanation:
Same as the vulnerability at line 233. The redirect URL lacked nonce protection, allowing CSRF attacks. The fix adds a dynamically generated nonce to the redirect URL to prevent unauthorized access to the import success page.

---

Vulnerability Existed: yes
TRUE POSITIVE
Insecure File Operations - CWE-434 - cube/classes/class-cubewp-import.php Line 389
[Old Code]
(is_dir("$dir/$file")) ? $this->remove_directory("$dir/$file") : unlink("$dir/$file");

[Fixed Code]
(is_dir("$dir/$file")) ? $this->remove_directory("$dir/$file") : wp_delete_file("$dir/$file");

Explanation:
Another instance of using PHP's native unlink() instead of WordPress's wp_delete_file(). The fix ensures consistency with WordPress security practices across all file deletion operations.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-load.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-load.php	2026-01-18 00:20:56.201778099 +0000@@ -1,11 +1,13 @@ <?php- /**  * CubeWp Initialization.  *  * @package cubewp/cube/classes  * @version 1.0  */++ // phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ defined('ABSPATH') || exit;  /**@@ -22,7 +24,7 @@      *      * @var string      */-    public static $CubeWp_version = '1.1.27';+    public static $CubeWp_version = '1.1.28';      /**      * Wordpress required version.

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: no
No CWE-identified vulnerabilities detected

Explanation:
This diff contains only non-security changes:

1. **Whitespace and formatting adjustments** - The removal of a blank line after `<?php` and addition of blank lines around the phpcs directive are purely stylistic.

2. **PHPcs directive addition** - The line `// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals` is a code quality/linting directive that disables a WordPress coding standard check. This is not a security change and doesn't introduce or fix security vulnerabilities.

3. **Version number update** - The version string is updated from `'1.1.27'` to `'1.1.28'`. This is a metadata change with no security implications.

**Conclusion:** This diff represents a routine version bump with formatting adjustments and a phpcs configuration comment. There are no security vulnerabilities being introduced or fixed in this change.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-plugin-updater.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-plugin-updater.php	2026-01-18 00:20:56.201778099 +0000@@ -6,6 +6,8 @@ // Exit if accessed directly if ( ! defined( 'ABSPATH' ) ) exit; +// phpcs:ignoreFile+ /**  * Allows plugins to use their own update API.  *@@ -229,27 +231,30 @@  	public function show_changelog() { -+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed. 		if( empty( $_REQUEST['edd_sl_action'] ) || 'view_plugin_changelog' != $_REQUEST['edd_sl_action'] ) { 			return; 		} +		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed. 		if( empty( $_REQUEST['plugin'] ) ) { 			return; 		} +		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed. 		if( empty( $_REQUEST['slug'] ) ) { 			return; 		}  		if( ! current_user_can( 'update_plugins' ) ) {-			wp_die( __( 'You do not have permission to install plugin updates', 'edd' ), __( 'Error', 'edd' ), array( 'response' => 403 ) );+			wp_die( esc_html__( 'You do not have permission to install plugin updates', 'cubewp-framework' ), esc_html__( 'Error', 'cubewp-framework' ), array( 'response' => 403 ) ); 		} -		$response = $this->api_request( 'plugin_latest_version', array( 'slug' => $_REQUEST['slug'] ) );+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+		$response = $this->api_request( 'plugin_latest_version', array( 'slug' => sanitize_text_field(wp_unslash($_REQUEST['slug'])) ) );  		if( $response && isset( $response->sections['changelog'] ) ) {-			echo '<div style="background:#fff;padding:10px;">' . $response->sections['changelog'] . '</div>';+			echo '<div style="background:#fff;padding:10px;">' . wp_kses_post($response->sections['changelog']) . '</div>'; 		}  

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-plugin-updater.php - Line 255

Old Code:
```php
echo '<div style="background:#fff;padding:10px;">' . $response->sections['changelog'] . '</div>';
```

Fixed Code:
```php
echo '<div style="background:#fff;padding:10px;">' . wp_kses_post($response->sections['changelog']) . '</div>';
```

Explanation:
The changelog content from an external API response was being output directly to the page without sanitization. This is a Stored/Reflected XSS vulnerability because an attacker could inject malicious JavaScript through the API response, which would then execute in the user's browser. The fix applies `wp_kses_post()` to sanitize the output, allowing safe HTML while stripping dangerous tags and event handlers.

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - cube/classes/class-cubewp-plugin-updater.php - Line 253

Old Code:
```php
$response = $this->api_request( 'plugin_latest_version', array( 'slug' => $_REQUEST['slug'] ) );
```

Fixed Code:
```php
$response = $this->api_request( 'plugin_latest_version', array( 'slug' => sanitize_text_field(wp_unslash($_REQUEST['slug'])) ) );
```

Explanation:
User input from `$_REQUEST['slug']` was being passed directly to the API without sanitization. This is a security issue because it could allow injection attacks or unexpected behavior. The fix applies `wp_unslash()` to handle magic quotes and `sanitize_text_field()` to remove potentially harmful characters, ensuring only safe input is sent to the API.

---

Vulnerability Existed: not sure
Improper Localization - CWE-546 - cube/classes/class-cubewp-plugin-updater.php - Line 250

Old Code:
```php
wp_die( __( 'You do not have permission to install plugin updates', 'edd' ), __( 'Error', 'edd' ), array( 'response' => 403 ) );
```

Fixed Code:
```php
wp_die( esc_html__( 'You do not have permission to install plugin updates', 'cubewp-framework' ), esc_html__( 'Error', 'cubewp-framework' ), array( 'response' => 403 ) );
```

Explanation:
The fix changes two things: (1) Uses `esc_html__()` instead of `__()` to escape the output before translation, which is a best practice for preventing XSS through translated strings; (2) Changes the text domain from 'edd' to 'cubewp-framework', which is correct for this plugin but technically a metadata change rather than a vulnerability fix. The `esc_html__()` addition is a minor hardening measure against potential XSS if translations contain untrusted content.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-query.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-query.php	2026-01-18 00:20:56.201778099 +0000@@ -88,16 +88,16 @@          // Sorting         if(isset($args['orderby']) && !empty($args['orderby'])){-            if (substr($args['orderby'], -strlen('-DESC')) === '-DESC') {+			if (substr($args['orderby'], -strlen('-DESC')) === '-DESC') {                 $custom_sort_field = substr($args['orderby'], 0, -strlen('-DESC'));                 $query['order'] = 'DESC';-                $query['orderby'] = 'meta_value_num';-                $query['meta_key'] = $custom_sort_field;+				$query['orderby'] = 'meta_value_num'; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key+				$query['meta_key'] = $custom_sort_field; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key             }elseif (substr($args['orderby'], -strlen('-ASC')) === '-ASC') {                 $custom_sort_field = substr($args['orderby'], 0, -strlen('-ASC'));                 $query['order'] = 'ASC';-                $query['orderby'] = 'meta_value_num';-                $query['meta_key'] = $custom_sort_field;+				$query['orderby'] = 'meta_value_num'; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key+				$query['meta_key'] = $custom_sort_field; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key             }else{                 if(isset($args['orderby']) && ($args['orderby'] == 'DESC' || $args['orderby'] == 'ASC')){                     $query['order'] = $args['orderby'];@@ -115,9 +115,9 @@         $extra_meta_query = isset($args['meta_query']) && !empty($args['meta_query']) ? $args['meta_query'] : array();                 if(!empty(self::$meta_query) && count(self::$meta_query) > 0){-            $query['meta_query'] = array_merge(self::$meta_query,$extra_meta_query);+			$query['meta_query'] = array_merge(self::$meta_query,$extra_meta_query); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query         }elseif(!empty($extra_meta_query) && count($extra_meta_query) > 0){-            $query['meta_query'] = $extra_meta_query;+			$query['meta_query'] = $extra_meta_query; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query         }          // Default Query arguments@@ -125,7 +125,7 @@             $query['s'] = $args['s'];         }         if(isset($args['post__not_in']) && !empty($args['post__not_in'])){-            $query['post__not_in'] = $args['post__not_in'];+			$query['post__not_in'] = $args['post__not_in']; // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in         }         if(isset($args['fields']) && !empty($args['fields'])){             $query['fields'] = $args['fields'];

Vulnerability Existed: no
[No Security Vulnerability] - [N/A] - [cube/classes/class-cubewp-query.php] [Lines 88-128]
[Old Code]
Lines with phpcs warnings but no phpcs:ignore comments addressing performance issues in WordPress queries.

[Fixed Code]
Lines 91, 94, 95, 118, 119, 128 now include phpcs:ignore comments for:
- WordPress.DB.SlowDBQuery.slow_db_query_meta_key
- WordPress.DB.SlowDBQuery.slow_db_query_meta_query
- WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in

Explanation:
This diff does not fix a security vulnerability. The changes are purely code quality improvements that suppress WordPress coding standard warnings about performance-impacting database query parameters. The code itself remains functionally identical—no logic changes, input validation, or security-related modifications are present. The phpcs:ignore comments are legitimate suppressions for known performance considerations in WordPress (meta_key, meta_query, and post__not_in parameters can impact database performance), but these are performance warnings, not security vulnerabilities. The code does not introduce or fix SQL injection, authorization bypass, data exposure, or other security flaws. The indentation changes (spaces to tabs) are formatting only. This is a maintenance commit to satisfy code standards compliance, not a security patch.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-relationships.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-relationships.php	2026-01-18 00:20:56.201778099 +0000@@ -154,7 +154,7 @@ 				} 			} 			$output .= '</div>';-+			// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 			echo $output; 		} 	}@@ -236,20 +236,21 @@ 			} 			$output .= '</div>'; +			// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 			echo $output; 		} 	}  	public function cubewp_remove_relation() {-		if ( ! wp_verify_nonce( sanitize_text_field( $_POST['nonce'] ), 'cubewp_remove_nonce' ) ) {+		if (!isset($_POST['nonce']) || ! wp_verify_nonce( sanitize_text_field( wp_unslash($_POST['nonce']) ), 'cubewp_remove_nonce' ) ) { 			wp_send_json( array( 				'status' => 'error', 				'msg'    => esc_html__( "Security verification failed. Try again later.", "cubewp-framework" ) 			) ); 		}-		$relation_id   = sanitize_text_field( $_POST['relation_id'] );-		$relation_of   = sanitize_text_field( $_POST['relation_of'] );-		$relation_with = sanitize_text_field( $_POST['relation_with'] );+		$relation_id   = isset($_POST['relation_id']) ? sanitize_text_field( wp_unslash($_POST['relation_id']) ) : '';+		$relation_of   = isset($_POST['relation_of']) ? sanitize_text_field( wp_unslash($_POST['relation_of']) ) : '';+		$relation_with = isset($_POST['relation_with']) ? sanitize_text_field( wp_unslash($_POST['relation_with']) ) : ''; 		if ( empty( $relation_id ) || empty( $relation_of ) || empty( $relation_with ) ) { 			wp_send_json( array( 				'status' => 'error',

# Security Analysis: PatchLeaks Code Diff

I'll analyze each change in the provided diff for security vulnerabilities.

---

## Vulnerability 1: Improper Input Validation

**Vulnerability Existed:** yes

**Unvalidated Nonce Verification - CWE-347** - CWE-347 - cube/classes/class-cubewp-relationships.php - Line 244

**Old Code:**
```php
if ( ! wp_verify_nonce( sanitize_text_field( $_POST['nonce'] ), 'cubewp_remove_nonce' ) ) {
```

**Fixed Code:**
```php
if (!isset($_POST['nonce']) || ! wp_verify_nonce( sanitize_text_field( wp_unslash($_POST['nonce']) ), 'cubewp_remove_nonce' ) ) {
```

**Explanation:**
The original code directly accessed `$_POST['nonce']` without checking if it exists first. This could cause a PHP notice/warning if the 'nonce' key doesn't exist in the $_POST array. The fixed code adds an `isset()` check and uses `wp_unslash()` to properly handle slashed input before sanitization, which is the correct WordPress pattern for handling $_POST data.

---

## Vulnerability 2: Missing Input Validation - relation_id Parameter

**Vulnerability Existed:** yes

**Improper Input Validation - CWE-20** - CWE-20 - cube/classes/class-cubewp-relationships.php - Line 250

**Old Code:**
```php
$relation_id   = sanitize_text_field( $_POST['relation_id'] );
```

**Fixed Code:**
```php
$relation_id   = isset($_POST['relation_id']) ? sanitize_text_field( wp_unslash($_POST['relation_id']) ) : '';
```

**Explanation:**
The original code directly accessed `$_POST['relation_id']` without checking existence. The fixed code adds proper isset() check and wp_unslash() handling. This prevents undefined index notices and ensures proper handling of PHP magic quotes (if enabled in legacy environments).

---

## Vulnerability 3: Missing Input Validation - relation_of Parameter

**Vulnerability Existed:** yes

**Improper Input Validation - CWE-20** - CWE-20 - cube/classes/class-cubewp-relationships.php - Line 251

**Old Code:**
```php
$relation_of   = sanitize_text_field( $_POST['relation_of'] );
```

**Fixed Code:**
```php
$relation_of   = isset($_POST['relation_of']) ? sanitize_text_field( wp_unslash($_POST['relation_of']) ) : '';
```

**Explanation:**
Same as above - added isset() check and wp_unslash() to properly validate the parameter before sanitization.

---

## Vulnerability 4: Missing Input Validation - relation_with Parameter

**Vulnerability Existed:** yes

**Improper Input Validation - CWE-20** - CWE-20 - cube/classes/class-cubewp-relationships.php - Line 252

**Old Code:**
```php
$relation_with = sanitize_text_field( $_POST['relation_with'] );
```

**Fixed Code:**
```php
$relation_with = isset($_POST['relation_with']) ? sanitize_text_field( wp_unslash($_POST['relation_with']) ) : '';
```

**Explanation:**
Same pattern - proper isset() and wp_unslash() handling added for this parameter.

---

## Note on Output Suppression Comments

The addition of `// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped` comments (lines 157 and 239) is not a security fix but rather a code quality suppression. These suppress PHPCS warnings about unescaped output. This is acceptable only if the output is confirmed to be safe HTML already validated elsewhere.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-rest-api.php	2026-01-18 00:20:47.473235790 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-rest-api.php	2026-01-18 00:20:56.201778099 +0000@@ -143,9 +143,7 @@ 				array( 					'methods'             => WP_REST_Server::READABLE, 					'callback'            => array($this, 'get_cubewp_posts'),-					'permission_callback' => function () {-						return true;-					},+					'permission_callback' => array($this, 'get_posts_permission_check'), 					'args'                => $this->get_render_params(), 				), 			)@@ -158,9 +156,7 @@ 				array( 					'methods'             => WP_REST_Server::READABLE, 					'callback'            => array($this, 'get_cubewp_posts_object'),-					'permission_callback' => function () {-						return true;-					},+					'permission_callback' => array($this, 'get_posts_permission_check'), 					'args'                => $this->get_render_params(), 				), 			)@@ -208,6 +204,19 @@ 	}  	/**+	 * Checks if a given request has permission to access posts via query endpoints.+	 * Allows public read access but respects WordPress post visibility rules.+	 *+	 * @param WP_REST_Request $request Full details about the request.+	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.+	 */+	public function get_posts_permission_check($request)+	{+		// Allow public read access (posts will be filtered for visibility)+		return true;+	}++	/** 	 * Retrieves the query params for the search results. 	 * 	 * @return array Collection parameters.@@ -259,12 +268,26 @@ 			$query  = new CubeWp_Query($cwp_query); 			$posts  = $query->cubewp_post_query(); 			if ($posts->have_posts()) {+				// Filter posts for visibility and security+				$filtered_posts = array();+				foreach ($posts->posts as $post) {+					// Check if user can read this post+					if (! $this->can_user_read_post($post)) {+						continue;+					}+					+					// Remove sensitive fields+					$safe_post = $this->sanitize_post_for_response($post);+					if ($safe_post) {+						$filtered_posts[] = $safe_post;+					}+				}+				 				$data = array(-					'total_posts'    => $posts->found_posts,-					'paged' => $posts->query['paged'],+					'total_posts'    => count($filtered_posts),+					'paged' => isset($posts->query['paged']) ? $posts->query['paged'] : 1, 					'max_num_pages' => $posts->max_num_pages,-					'posts' => $posts->posts,-+					'posts' => $filtered_posts, 				); 				return $data; 			} else {@@ -285,6 +308,13 @@ 				while ($posts->have_posts()) { 					$posts->the_post(); 					$post_id = get_the_ID();+					$post = get_post($post_id);+					+					// Check if user can read this post+					if (! $this->can_user_read_post($post)) {+						continue;+					}+					 					$return[$post_id]['ID'] = $post_id; 					$return[$post_id]['title'] = get_the_title(); 					if (has_post_thumbnail()) {@@ -305,23 +335,15 @@ 						} 					} 					$return[$post_id]['taxonomies'] = isset($post_terms) && ! empty($post_terms) ? array_filter($post_terms) : array();-					$post_meta = get_post_meta($post_id);+					+					// Get and filter post meta - only expose safe/public meta+					$post_meta = $this->get_safe_post_meta($post_id); -					// Iterate over each meta value-					foreach ($post_meta as $key => $values) {-						foreach ($values as $index => $value) {-							// Check if the value is serialized-							if (is_serialized($value)) {-								$return[$post_id]['post_meta'][$key] = maybe_unserialize($value);-							} else {-								$return[$post_id]['post_meta'][$key] = $value;-							}-						}-					}+					$return[$post_id]['post_meta'] = $post_meta; 				} 				$data = array(-					'total_posts'    => $posts->found_posts,-					'paged' => $posts->query['paged'],+					'total_posts'    => count($return),+					'paged' => isset($posts->query['paged']) ? $posts->query['paged'] : 1, 					'max_num_pages' => $posts->max_num_pages, 					'posts' => $return, @@ -819,6 +841,137 @@ 		return array_unique($field_names); // Remove duplicates 	} +	/**+	 * Check if the current user can read a specific post.+	 * Respects WordPress post visibility rules including password protection.+	 *+	 * @param WP_Post|object|int $post Post object or post ID.+	 * @return bool True if user can read the post, false otherwise.+	 */+	private function can_user_read_post($post)+	{+		if (is_numeric($post)) {+			$post = get_post($post);+		}+		+		if (! $post || ! is_object($post)) {+			return false;+		}+		+		// Check post status+		if ($post->post_status !== 'publish') {+			// Only allow non-published posts if user has edit permission+			if (! current_user_can('edit_post', $post->ID)) {+				return false;+			}+		}+		+		// Check password protection - password-protected posts should not be exposed via public API+		if (! empty($post->post_password)) {+			// Only allow if user has edit permission (admin/author)+			if (! current_user_can('edit_post', $post->ID)) {+				// For REST API, we don't have cookie-based password verification+				// So we exclude password-protected posts from public API responses+				return false;+			}+		}+		+		// Check if post type is publicly queryable+		$post_type = get_post_type_object($post->post_type);+		if (! $post_type) {+			return false;+		}+		+		if (! $post_type->publicly_queryable) {+			// Only allow if user can read this post type+			if (! current_user_can($post_type->cap->read_post, $post->ID)) {+				return false;+			}+		}+		+		return true;+	}++	/**+	 * Sanitize post object for API response by removing sensitive fields.+	 *+	 * @param WP_Post|object $post Post object.+	 * @return array|false Sanitized post array or false if post should be excluded.+	 */+	private function sanitize_post_for_response($post)+	{+		if (is_object($post)) {+			$post_array = (array) $post;+		} else {+			$post_array = $post;+		}+		+		// Remove sensitive fields+		unset($post_array['post_password']);+		+		// If post is password protected and user doesn't have edit permission, hide content+		if (! empty($post_array['post_password']) && ! current_user_can('edit_post', $post_array['ID'])) {+			// Don't expose password-protected content+			$post_array['post_content'] = '';+			$post_array['post_excerpt'] = '';+		}+		+		return $post_array;+	}++	/**+	 * Get safe post meta that can be exposed via API.+	 * Filters out private meta keys (starting with _) and sensitive data.+	 *+	 * @param int $post_id Post ID.+	 * @return array Filtered post meta array.+	 */+	private function get_safe_post_meta($post_id)+	{+		$all_meta = get_post_meta($post_id);+		$safe_meta = array();+		+		// Get list of CubeWP custom fields that should be exposed+		$cubewp_fields = array();+		if (class_exists('CubeWp_Single_Cpt')) {+			$cubewp_fields = CubeWp_Single_Cpt::cubewp_post_metas($post_id, true);+			if (is_array($cubewp_fields)) {+				$cubewp_fields = array_keys($cubewp_fields);+			}+		}+		+		foreach ($all_meta as $key => $values) {+			// Skip private meta keys (starting with _) unless they're registered CubeWP fields+			if (strpos($key, '_') === 0 && ! in_array($key, $cubewp_fields, true)) {+				continue;+			}+			+			// Skip sensitive WordPress internal meta+			$sensitive_keys = array(+				'_edit_lock',+				'_edit_last',+				'_wp_old_slug',+				'_wp_old_date',+			);+			if (in_array($key, $sensitive_keys, true)) {+				continue;+			}+			+			// Process meta values - get_post_meta returns array of values+			if (is_array($values) && ! empty($values)) {+				$value = $values[0]; // Get first value+				// Check if the value is serialized+				if (is_serialized($value)) {+					$safe_meta[$key] = maybe_unserialize($value);+				} else {+					$safe_meta[$key] = $value;+				}+			}+		}+		+		return $safe_meta;+	}+ 	public static function init() 	{ 		$CubeClass = __CLASS__;

# Security Analysis: CubeWP REST API Patch

---

## Vulnerability 1

**Vulnerability Existed:** yes

**Broken Access Control (Authorization Bypass) - CWE-639** - `cube/classes/class-cubewp-rest-api.php` Lines 146-148, 159-161

**Old Code:**
```php
'permission_callback' => function () {
    return true;
},
```

**Fixed Code:**
```php
'permission_callback' => array($this, 'get_posts_permission_check'),
```

**Explanation:**
The original code had a hardcoded permission callback that always returned `true`, granting unrestricted access to REST API endpoints regardless of user authentication or capabilities. This is a critical authorization bypass vulnerability. The fix delegates to a proper permission check method, though the implementation still allows public read access (which may be intentional depending on use case requirements).

---

## Vulnerability 2

**Vulnerability Existed:** yes

**Sensitive Data Exposure - CWE-200** - `cube/classes/class-cubewp-rest-api.php` Lines 268-285 (old code)

**Old Code:**
```php
$data = array(
    'total_posts'    => $posts->found_posts,
    'paged' => $posts->query['paged'],
    'max_num_pages' => $posts->max_num_pages,
    'posts' => $posts->posts,
);
```

**Fixed Code:**
```php
// Filter posts for visibility and security
$filtered_posts = array();
foreach ($posts->posts as $post) {
    // Check if user can read this post
    if (! $this->can_user_read_post($post)) {
        continue;
    }
    
    // Remove sensitive fields
    $safe_post = $this->sanitize_post_for_response($post);
    if ($safe_post) {
        $filtered_posts[] = $safe_post;
    }
}

$data = array(
    'total_posts'    => count($filtered_posts),
    'paged' => isset($posts->query['paged']) ? $posts->query['paged'] : 1,
    'max_num_pages' => $posts->max_num_pages,
    'posts' => $filtered_posts,
);
```

**Explanation:**
The original code exposed all post objects directly without filtering for visibility rules or removing sensitive fields like post passwords. This could expose draft/private posts and password-protected content to unauthorized users. The fix implements post visibility checks and sanitization to remove sensitive fields before API responses.

---

## Vulnerability 3

**Vulnerability Existed:** yes

**Sensitive Data Exposure - CWE-200** - `cube/classes/class-cubewp-rest-api.php` Lines 338-348 (old code)

**Old Code:**
```php
$post_meta = get_post_meta($post_id);

// Iterate over each meta value
foreach ($post_meta as $key => $values) {
    foreach ($values as $index => $value) {
        // Check if the value is serialized
        if (is_serialized($value)) {
            $return[$post_id]['post_meta'][$key] = maybe_unserialize($value);
        } else {
            $return[$post_id]['post_meta'][$key] = $value;
        }
    }
}
```

**Fixed Code:**
```php
// Get and filter post meta - only expose safe/public meta
$post_meta = $this->get_safe_post_meta($post_id);

$return[$post_id]['post_meta'] = $post_meta;
```

**Explanation:**
The original code exposed all post metadata including private fields (prefixed with `_`) without any filtering. WordPress reserves private meta keys for internal use, and exposing them via REST API can leak sensitive configuration data, edit locks, and other WordPress internals. The fix implements a whitelist-based approach via `get_safe_post_meta()` that filters out private meta keys and known sensitive fields.

---

## Summary

This patch addresses **3 critical security vulnerabilities**:
1. **Broken Access Control** - Unrestricted API access due to hardcoded permission bypass
2. **Post Visibility Bypass** - Exposure of draft/private/password-protected posts
3. **Private Metadata Exposure** - Leakage of WordPress internal and sensitive meta fields

The fixes implement proper authorization checks, post visibility filtering, and metadata sanitization.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-saved.php	2026-01-18 00:20:47.477236039 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-saved.php	2026-01-18 00:20:56.201778099 +0000@@ -30,7 +30,8 @@      */     public static function cubewp_saved_post_cookies(){         // Load current favourite posts from cookie-        $savePosts = (isset($_COOKIE['CWP_Saved'])) ? explode(',', (string) sanitize_text_field( $_COOKIE['CWP_Saved'] )) : array();+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+        $savePosts = (isset($_COOKIE['CWP_Saved'])) ? explode(',', (string) sanitize_text_field( wp_unslash($_COOKIE['CWP_Saved']) )) : array();         $savePosts = array_map('absint', $savePosts); // Clean cookie input, it's user input!         return $savePosts;     }@@ -42,11 +43,11 @@      * @since  1.0.0      */     public static function cubewp_save_post(){-        if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-alert-nonce') ) {+        if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-alert-nonce') ) {             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        $post_id = isset($_POST['post-id']) ? sanitize_text_field($_POST['post-id']) : 0;+        $post_id = isset($_POST['post-id']) ? sanitize_text_field(wp_unslash($_POST['post-id'])) : 0;         if( isset($post_id) && $post_id > 0 ){             $savePosts = self::cubewp_saved_post_cookies();             @@ -69,6 +70,7 @@             wp_send_json(                 array(                     'type'        =>  'success',+                    /* translators: %s: post type singular name. */                     'msg'         =>  sprintf(__('Success! Your %s has been saved.', 'cubewp-framework'), get_post_type_object( get_post_type($post_id) )->labels->singular_name),                     'text'        =>  sprintf(__('Saved', 'cubewp-framework'),get_post_type($post_id)),                 )@@ -83,11 +85,11 @@      * @since  1.0.0      */     public static function cubewp_remove_saved_posts(){-        if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-alert-nonce') ) {+        if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-alert-nonce') ) {             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework') ) );             wp_die();         }-        $post_id = isset($_POST['post-id']) ? sanitize_text_field($_POST['post-id']) : 0;+        $post_id = isset($_POST['post-id']) ? sanitize_text_field(wp_unslash($_POST['post-id'])) : 0;         if( isset($post_id) && $post_id > 0 ){             $savePosts = self::cubewp_saved_post_cookies(); @@ -119,6 +121,7 @@             wp_send_json(                 array(                     'type'        =>  'success',+                    /* translators: %s: post type singular name. */                     'msg'         =>  sprintf(__('Success! Your %s has been removed from saved posts.', 'cubewp-framework'), get_post_type_object( get_post_type($post_id) )->labels->singular_name),                     'text'        =>  sprintf(__('Save', 'cubewp-framework'), get_post_type($post_id)),                 )@@ -237,6 +240,7 @@                                 <?php                                 while($the_query->have_posts()): $the_query->the_post();                                     $post_id=get_the_ID();+                                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped                                     echo CubeWp_frontend_grid_HTML($post_id, $col_class = 'cwp-col-12 cwp-col-md-6');                                 endwhile;                                 ?>@@ -246,7 +250,7 @@                         $grid_view_html = ob_get_contents();                     ob_end_clean();                 }-                wp_reset_query();+                wp_reset_postdata();             }             return $grid_view_html;         }

I'll analyze this code diff for security vulnerabilities following the specified format.

---

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE

CWE-602 - Client-Side Enforcement of Server-Side Security - class-cubewp-saved.php - Line 33

[Old Code]
```php
$savePosts = (isset($_COOKIE['CWP_Saved'])) ? explode(',', (string) sanitize_text_field( $_COOKIE['CWP_Saved'] )) : array();
```

[Fixed Code]
```php
$savePosts = (isset($_COOKIE['CWP_Saved'])) ? explode(',', (string) sanitize_text_field( wp_unslash($_COOKIE['CWP_Saved']) )) : array();
```

Explanation:
The old code failed to apply `wp_unslash()` before sanitizing the cookie value. In WordPress, `$_COOKIE` values may contain escaped slashes (magic quotes behavior in some configurations), and `wp_unslash()` should be applied before sanitization to properly handle slashed input. This is a WordPress security best practice to ensure consistent data handling.

---

**Vulnerability 2:**

Vulnerability Existed: yes
TRUE POSITIVE

CWE-347 - Improper Verification of Cryptographic Signature - class-cubewp-saved.php - Line 46

[Old Code]
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-alert-nonce') ) {
```

[Fixed Code]
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-alert-nonce') ) {
```

Explanation:
The nonce value from `$_POST` was passed directly to `wp_verify_nonce()` without sanitization or unslashing. The `wp_verify_nonce()` function expects a properly cleaned string. By applying `wp_unslash()` and `sanitize_text_field()`, the fix ensures the nonce is properly cleaned before verification, preventing potential bypass vulnerabilities due to unexpected character encoding or slashing.

---

**Vulnerability 3:**

Vulnerability Existed: yes
TRUE POSITIVE

CWE-20 - Improper Input Validation - class-cubewp-saved.php - Line 50

[Old Code]
```php
$post_id = isset($_POST['post-id']) ? sanitize_text_field($_POST['post-id']) : 0;
```

[Fixed Code]
```php
$post_id = isset($_POST['post-id']) ? sanitize_text_field(wp_unslash($_POST['post-id'])) : 0;
```

Explanation:
Missing `wp_unslash()` before sanitization. User input from `$_POST` may contain escaped slashes that need to be unslashed before sanitization to properly clean the data. This ensures consistent handling of potentially escaped input.

---

**Vulnerability 4:**

Vulnerability Existed: yes
FALSE POSITIVE

CWE-347 - Improper Verification of Cryptographic Signature - class-cubewp-saved.php - Line 88

[Old Code]
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-alert-nonce') ) {
```

[Fixed Code]
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-alert-nonce') ) {
```

Explanation:
Same vulnerability as #2 - nonce value passed without sanitization/unslashing. The fix ensures proper data cleaning before cryptographic nonce verification.

---

**Vulnerability 5:**

Vulnerability Existed: yes
TRUE POSITIVE

CWE-20 - Improper Input Validation - class-cubewp-saved.php - Line 92

[Old Code]
```php
$post_id = isset($_POST['post-id']) ? sanitize_text_field($_POST['post-id']) : 0;
```

[Fixed Code]
```php
$post_id = isset($_POST['post-id']) ? sanitize_text_field(wp_unslash($_POST['post-id'])) : 0;
```

Explanation:
Same vulnerability as #3 - missing `wp_unslash()` before sanitizing POST data containing potentially escaped characters.

---

**Vulnerability 6:**

Vulnerability Existed: yes
FALSE POSITIVE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code - class-cubewp-saved.php - Line 243

[Old Code]
```php
echo CubeWp_frontend_grid_HTML($post_id, $col_class = 'cwp-col-12 cwp-col-md-6');
```

[Fixed Code]
```php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo CubeWp_frontend_grid_HTML($post_id, $col_class = 'cwp-col-12 cwp-col-md-6');
```

Explanation:
The fix adds a phpcs ignore comment, but does not actually escape the output from `CubeWp_frontend_grid_HTML()`. This is not a true security fix - it only suppresses the PHPCS warning. The underlying vulnerability (unescaped output) remains. The function output should be properly escaped with `wp_kses_post()`, `esc_html()`, or similar, depending on the expected content type.

---

**Non-Vulnerability (Code Quality):**

Vulnerability Existed: no

CWE-N/A - class-cubewp-saved.php - Line 253

[Old Code]
```php
wp_reset_query();
```

[Fixed Code]
```php
wp_reset_postdata();
```

Explanation:
This change replaces `wp_reset_query()` with `wp_reset_postdata()`. This is a WordPress best practice correction, not a security fix. `wp_reset_postdata()` is the preferred function to reset the global post data after using `WP_Query`, while `wp_reset_query()` is deprecated in favor of `wp_reset_postdata()`.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-single-cpt.php	2026-01-18 00:20:47.477236039 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-single-cpt.php	2026-01-18 00:20:56.201778099 +0000@@ -94,8 +94,8 @@                             $value = self::get_single_meta_value($meta_key, $field_type);                             $args[$meta_key] = array(                                 'type'                  =>    $field_type,-                                'meta_key'              =>    $meta_key,-                                'meta_value'            =>    $value,+                                'meta_key'              =>    $meta_key,// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key+                                'meta_value'            =>    $value,// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value                                 'label'                 =>    $label,                             );                         }@@ -213,7 +213,7 @@     public static function field_author()     {         $user_id = self::$author_id;-        return get_user_details($user_id);+        return cubewp_get_user_details($user_id);     }      /**@@ -284,7 +284,8 @@             } else if (method_exists(__CLASS__, 'field_' . $field_type)) {                 $output .= call_user_func(array(__CLASS__, 'field_' . $field_type), $options);             } else {-                $output .= '<p style="color: #ff0000">' . sprintf(esc_html__("Invalid Field Type: %s", "cubewp-framework"), $field_type) . '</p>';+                /* translators: %s: field type. */+                $output .= '<p style="color: #ff0000">' . sprintf( esc_html__( "Invalid Field Type: %s", "cubewp-framework" ), $field_type ) . '</p>';             }         }         return $output;@@ -411,6 +412,7 @@      */     public static function get_single_sidebar_area()     {+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped         echo self::get_post_sidebar();     }     /**@@ -420,6 +422,7 @@      */     public static function get_single_content_area()     {+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped         echo self::get_post_content();     } 

I'll analyze this code diff for security vulnerabilities.

Vulnerability 1: Security Bypass via phpcs Ignore Comments
    Vulnerability Existed: yes
FALSE POSITIVE
    Unescaped Output - CWE-79 - cube/classes/class-cubewp-single-cpt.php - Lines 415, 425
    [Old Code]
    echo self::get_post_sidebar();
    echo self::get_post_content();
    [Fixed Code]
    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
    echo self::get_post_sidebar();
    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
    echo self::get_post_content();
    Explanation:
    The addition of "phpcs:ignore" comments at lines 415 and 425 suppresses WordPress security warnings about unescaped output without actually fixing the underlying vulnerability. The output from `self::get_post_sidebar()` and `self::get_post_content()` is echoed directly to the page without any escaping (esc_html, wp_kses, etc.). This is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) vulnerability. Adding phpcs comments that tell the linter to ignore the warning does NOT remediate the vulnerability—it only hides it from static analysis. Any user-controlled data in the post sidebar or content could be injected as malicious scripts.

Vulnerability 2: WordPress Function Name Change
    Vulnerability Existed: yes
FALSE POSITIVE
    Use of Undefined Function - CWE-440 - cube/classes/class-cubewp-single-cpt.php - Line 216
    [Old Code]
    return get_user_details($user_id);
    [Fixed Code]
    return cubewp_get_user_details($user_id);
    Explanation:
    The function `get_user_details()` does not exist in WordPress core or standard plugins. It was either a custom function that was removed or undefined, creating a fatal error condition. The fix changes it to `cubewp_get_user_details()`, which appears to be a properly namespaced custom function. While this fixes the undefined function issue, it's not a security vulnerability per se, but rather a functional bug that could cause the application to crash. However, this is a best practice correction (using namespaced functions to avoid conflicts).

Vulnerability 3: Code Quality - Formatting and Comment Changes
    Vulnerability Existed: no
    Code Style Enhancement - No CWE - cube/classes/class-cubewp-single-cpt.php - Lines 97-98, 287-288
    [Old Code]
    'meta_key'              =>    $meta_key,
    'meta_value'            =>    $value,
    sprintf(esc_html__("Invalid Field Type: %s", "cubewp-framework"), $field_type)
    [Fixed Code]
    'meta_key'              =>    $meta_key,// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
    'meta_value'            =>    $value,// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
    sprintf( esc_html__( "Invalid Field Type: %s", "cubewp-framework" ), $field_type )
    Explanation:
    These changes add phpcs ignore comments and improve formatting/spacing. The phpcs comments suppress warnings about slow database queries when using meta_key and meta_value in queries. These are intentional linter suppressions where the developer has acknowledged the performance implications. The formatting changes improve WordPress coding standards compliance (proper spacing around function parameters). These are not security vulnerabilities but code quality improvements.

---

**Summary**: The most significant security concern is the unescaped output issue at lines 415 and 425, where phpcs ignore comments mask but do not fix a potential XSS vulnerability.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-single-page-trait.php	2026-01-18 00:20:47.477236039 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-single-page-trait.php	2026-01-18 00:20:56.201778099 +0000@@ -1,4 +1,5 @@ <?php+ /**  * CubeWp single page trait contains all type of field's HTML for single page.  *@@ -6,12 +7,13 @@  * @package cubewp/cube/classes  */ -if ( ! defined( 'ABSPATH' ) ) {+if (! defined('ABSPATH')) { 	exit; } -trait CubeWp_Single_Page_Trait {-	+trait CubeWp_Single_Page_Trait+{+ 	/** 	 * Method field_taxonomy 	 *@@ -20,29 +22,30 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_taxonomy($args = array()) {+	public static function field_taxonomy($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );+		$args['value'] = cwp_handle_data_format($args); 		$output = null; 		if (isset($args['value']) && ! empty($args['value']) && is_array($args['value'])) {-			$output = '<div class="cwp-cpt-single-category-container cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">';+			$output = '<div class="cwp-cpt-single-category-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">'; 			$output .= '<h4>' . $args['label'] . '</h4>'; 			$output .= '<ul class="cwp-single-category-widget-inner ' . $args['class'] . '">';-				foreach ($args['value'] as $terms) {-					$output .= '<li>+			foreach ($args['value'] as $terms) {+				$output .= '<li> 	                    <a href="' . get_term_link($terms) . '"> 	                        <p>' . $terms->name . '</p> 	                    </a> 	                </li>';-				}-				$output .= '</div>';+			}+			$output .= '</div>'; 			$output .= '</ul>'; 		}  		return apply_filters('cubewp/singlecpt/field/taxonomy', $output, $args); 	}-	+ 	/** 	 * Method field_text 	 *@@ -51,12 +54,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_text($args = array()) {+	public static function field_text($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-text-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-text-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-text ' . $args['class'] . '"><p>' . esc_html($args['value']) . '</p></div> 			</div>';@@ -64,21 +68,22 @@  		return apply_filters('cubewp/singlecpt/field/text', $output, $args); 	}-	+ 	/** 	 * Method field_number 	 *-	* @param array $args field data+	 * @param array $args field data 	 * 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_number($args = array()) {+	public static function field_number($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-number-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-number-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-number ' . $args['class'] . '"> 					' . esc_html($args['value']) . '@@ -88,7 +93,7 @@  		return apply_filters('cubewp/singlecpt/field/number', $output, $args); 	}-	+ 	/** 	 * Method field_email 	 *@@ -97,12 +102,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_email($args = array()) {+	public static function field_email($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-email-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-email-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-email ' . $args['class'] . '"> 					<a href="mailto:' . esc_html($args['value']) . '">' . esc_html($args['value']) . '</a>@@ -112,30 +118,31 @@  		return apply_filters('cubewp/singlecpt/field/email', $output, $args); 	}-	+ 	/** 	 * Method field_url 	 *-	* @param array $args field data+	 * @param array $args field data 	 * 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_url($args = array()) {-		$args['container_class'] = isset( $args['container_class'] ) ? $args['container_class'] : '';+	public static function field_url($args = array())+	{+		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$rel_attr = '';-		$field_name = isset( $args['name'] ) && ! empty( $args['name'] ) ? $args['name'] : '';-		if ( ! empty( $field_name ) ) {-			$field = get_field_options( $field_name );-			$rel = isset( $field['rel_attr'] ) && ! empty( $field['rel_attr'] ) ? $field['rel_attr'] : '';-			if ( ! empty( $rel ) && $rel != 'do-follow' ) {-				$rel_attr = 'rel="' . esc_attr( $rel ) . '"';+		$field_name = isset($args['name']) && ! empty($args['name']) ? $args['name'] : '';+		if (! empty($field_name)) {+			$field = get_field_options($field_name);+			$rel = isset($field['rel_attr']) && ! empty($field['rel_attr']) ? $field['rel_attr'] : '';+			if (! empty($rel) && $rel != 'do-follow') {+				$rel_attr = 'rel="' . esc_attr($rel) . '"'; 			} 		} 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-url-container cwp-cpt-single-field-container ' . esc_attr( $args['container_class'] ) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-url-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-url ' . $args['class'] . '"> 					<a ' . $rel_attr . ' href="' . esc_url($args['value']) . '">' . esc_url($args['value']) . '</a>@@ -145,7 +152,7 @@  		return apply_filters('cubewp/singlecpt/field/url', $output, $args); 	}-	+ 	/** 	 * Method field_password 	 *@@ -154,12 +161,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_password($args = array()) {+	public static function field_password($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-password-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-password-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-password ' . $args['class'] . '"> 					<input type="password" value="' . esc_html($args['value']) . '" readonly disabled>@@ -169,7 +177,7 @@  		return apply_filters('cubewp/singlecpt/field/password', $output, $args); 	}-	+ 	/** 	 * Method field_textarea 	 *@@ -178,12 +186,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_textarea($args = array()) {+	public static function field_textarea($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-textarea-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-textarea-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-textarea ' . $args['class'] . '"> 					<p>' . wp_kses_post($args['value']) . '</p>@@ -193,7 +202,7 @@  		return apply_filters('cubewp/singlecpt/field/textarea', $output, $args); 	}-	+ 	/** 	 * Method field_wysiwyg_editor 	 *@@ -202,12 +211,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_wysiwyg_editor($args = array()) {+	public static function field_wysiwyg_editor($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-wysiwyg_editor-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-wysiwyg_editor-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-wysiwyg_editor ' . $args['class'] . '"> 					' . wp_kses_post($args['value']) . '@@ -217,7 +227,7 @@  		return apply_filters('cubewp/singlecpt/field/wysiwyg_editor', $output, $args); 	}-	+ 	/** 	 * Method field_oembed 	 *@@ -226,22 +236,23 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_oembed($args = array()) {+	public static function field_oembed($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-        if(!empty(wp_oembed_get($args['value']))){-			$output = '<div class="cwp-cpt-single-oembed-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty(wp_oembed_get($args['value']))) {+			$output = '<div class="cwp-cpt-single-oembed-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 	            <h4>' . $args['label'] . '</h4> 	            <div class="cwp-cpt-single-oembed ' . $args['class'] . '"> 		            ' . wp_oembed_get($args['value']) . ' 	            </div> 	        </div>';-        }+		}  		return apply_filters('cubewp/singlecpt/field/oembed', $output, $args); 	}-	+ 	/** 	 * Method field_gallery 	 *@@ -250,38 +261,39 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_gallery($args = array()) {-		wp_enqueue_script( 'cubewp-pretty-photo' );-		wp_enqueue_style( 'cubewp-pretty-photo' );+	public static function field_gallery($args = array())+	{+		wp_enqueue_script('cubewp-pretty-photo');+		wp_enqueue_style('cubewp-pretty-photo');  		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );-		if (is_array($args['value']) && ! empty( $args['value'] )) {+		$args['value'] = cwp_handle_data_format($args);+		if (is_array($args['value']) && ! empty($args['value'])) { 			$gallery_id = $args['id'] ?? wp_rand();-			$output .= '<div class="cwp-cpt-single-gallery-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+			$output .= '<div class="cwp-cpt-single-gallery-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">                 <h4>' . $args['label'] . '</h4>                 <div class="cwp-cpt-single-gallery ' . $args['class'] . '">';-				foreach ($args['value'] as $galleryItemID) {-					$galleryItemID = cwp_get_attachment_id( $galleryItemID );-					$galleryItemURL     = wp_get_attachment_url($galleryItemID);-					$galleryItemCaption = wp_get_attachment_caption($galleryItemID);-					if (empty($galleryItemCaption)) {-						$galleryItemCaption = esc_html__('Gallery Image', 'cubewp-framework');-					}-					$output .= '<a href="' . esc_url($galleryItemURL) . '" rel="prettyPhoto[' . $gallery_id . ']" title="" class="cwp-cpt-single-gallery-item">';-					$output .= '<img src="' . esc_url($galleryItemURL) . '" alt="' . esc_attr($galleryItemCaption) . '">';-					$output .= '</a>';+			foreach ($args['value'] as $galleryItemID) {+				$galleryItemID = cwp_get_attachment_id($galleryItemID);+				$galleryItemURL     = wp_get_attachment_url($galleryItemID);+				$galleryItemCaption = wp_get_attachment_caption($galleryItemID);+				if (empty($galleryItemCaption)) {+					$galleryItemCaption = esc_html__('Gallery Image', 'cubewp-framework'); 				}-				$output .= '</div>+				$output .= '<a href="' . esc_url($galleryItemURL) . '" rel="prettyPhoto[' . $gallery_id . ']" title="" class="cwp-cpt-single-gallery-item">';+				$output .= '<img src="' . esc_url($galleryItemURL) . '" alt="' . esc_attr($galleryItemCaption) . '">';+				$output .= '</a>';+			}+			$output .= '</div>             </div>'; 		}  		return apply_filters('cubewp/singlecpt/field/gallery', $output, $args); 	}-	+ 	/** 	 * Method field_file 	 *@@ -290,26 +302,27 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_file($args = array()) {-        $args['field_size'] = isset($args['field_size']) ? $args['field_size'] : '';+	public static function field_file($args = array())+	{+		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		$args['value'] = cwp_get_attachment_id( $args['value'] );+		$args['value'] = cwp_get_attachment_id($args['value']); 		$fileItemURL = wp_get_attachment_url($args['value']);-        if(!empty($fileItemURL)){-		$output      = '<div class="cwp-cpt-single-file-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($fileItemURL)) {+			$output      = '<div class="cwp-cpt-single-file-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">             <h4>' . $args['label'] . '</h4>             <div class="cwp-cpt-single-file ' . $args['class'] . '">                 <a href="' . esc_url($fileItemURL) . '" download>' . esc_html__('Download File', 'cubewp-framework') . '</a>             </div>         </div>';-        }else{-            $output='';-        }+		} else {+			$output = '';+		}  		return apply_filters('cubewp/singlecpt/field/file', $output, $args); 	}-	+ 	/** 	 * Method field_switch 	 *@@ -318,13 +331,14 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_switch($args = array()) {+	public static function field_switch($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$args['value'] = esc_html__( $args['value'], 'cubewp-framework' );-			$output = '<div class="cwp-cpt-single-switch-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$args['value'] = esc_html($args['value']);+			$output = '<div class="cwp-cpt-single-switch-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-switch ' . $args['class'] . '"><p>' . esc_html($args['value']) . '</p></div> 			</div>';@@ -332,7 +346,7 @@  		return apply_filters('cubewp/singlecpt/field/switch', $output, $args); 	}-	+ 	/** 	 * Method field_dropdown 	 *@@ -341,30 +355,31 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_dropdown($args = array()) {+	public static function field_dropdown($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-switch-dropdown cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		$args['value'] = cwp_handle_data_format($args);+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-switch-dropdown cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<ul class="' . $args['class'] . '">';-					if (is_array($args['value'])) {-						foreach ($args['value'] as $dropdownValue):-							$output .= '<li>' . esc_html($dropdownValue) . '</li>';-						endforeach;-					} else {-						$output .= '<li>' . esc_html($args['value']) . '</li>';-					}-				$output .= '</ul>+			if (is_array($args['value'])) {+				foreach ($args['value'] as $dropdownValue):+					$output .= '<li>' . esc_html($dropdownValue) . '</li>';+				endforeach;+			} else {+				$output .= '<li>' . esc_html($args['value']) . '</li>';+			}+			$output .= '</ul> 			</div>'; 		}  		return apply_filters('cubewp/singlecpt/field/dropdown', $output, $args); 	}-	+ 	/** 	 * Method field_checkbox 	 *@@ -373,15 +388,16 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_checkbox($args = array()) {-		+	public static function field_checkbox($args = array())+	{+ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );-        if (!empty($args['value'])){-		$output = '<div class="cwp-cpt-single-switch-checkbox cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		$args['value'] = cwp_handle_data_format($args);+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-switch-checkbox cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">             <h4>' . $args['label'] . '</h4>'; 			$output .= '<ul class="' . $args['class'] . '">'; 			if (is_array($args['value'])) {@@ -392,14 +408,14 @@ 				$output .= '<li>' . esc_html($args['value']) . '</li>'; 			} 			$output .= '</ul>';-		$output .= '</div>';-        }else{-            return '';-        }+			$output .= '</div>';+		} else {+			return '';+		}  		return apply_filters('cubewp/singlecpt/field/checkbox', $output, $args); 	}-	+ 	/** 	 * Method field_radio 	 *@@ -408,12 +424,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_radio($args = array()) {+	public static function field_radio($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-switch-radio cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-switch-radio cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<ul class="' . $args['class'] . '"> 					<li>' . esc_html($args['value']) . '</li>@@ -424,7 +441,7 @@ 		return apply_filters('cubewp/singlecpt/field/radio', $output, $args); 	} -		/**+	/** 	 * Method field_business_hours 	 * 	 * @param array $args field data@@ -432,23 +449,24 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_business_hours($args = array()) {+	public static function field_business_hours($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : '';-        $output = null;-        if (!empty($args['value']) && is_array($args['value'])) {+		$output = null;+		if (!empty($args['value']) && is_array($args['value'])) { 			$status = cwp_business_hours_status($args['value']);-            $output = '<div class="cwp-cpt-single-business_hours cwp-cpt-single-field-container' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">+			$output = '<div class="cwp-cpt-single-business_hours cwp-cpt-single-field-container' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4>-				<p class="cwp-business-status '.$status.'">'.$status.'</p>+				<p class="cwp-business-status ' . $status . '">' . $status . '</p> 				<div class="cwp-business-hours ' . $args['class'] . '">'; 			$time_format = get_option('time_format'); 			foreach ($args['value'] as $day => $times) { 				$output .= '<div class="cwp-cpt-single-field-container">'; 				$output .= '<h6>' . ucfirst($day) . '</h6>';-				if(!is_array($times) && is_string($times) && $times == '24-hours-open'){-					$output .= '<p> '. __('24 Hours Open','cubewp-framework') .'</p>';-				}else{+				if (!is_array($times) && is_string($times) && $times == '24-hours-open') {+					$output .= '<p> ' . __('24 Hours Open', 'cubewp-framework') . '</p>';+				} else { 					$openTimes = $times['open']; 					$closeTimes = $times['close']; 					$output .= '<div class="cwp-single-day-timings">';@@ -459,16 +477,16 @@ 					} 					$output .= '</div>'; 				}-				-				++ 				$output .= '</div>'; 			}-            $output .= '</div>+			$output .= '</div> 			</div>';-        }+		} 		return apply_filters('cubewp/singlecpt/field/business_hour', $output, $args); 	}-	+ 	/** 	 * Method field_google_address 	 *@@ -477,11 +495,12 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_google_address($args = array()) {+	public static function field_google_address($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if (is_array($args['value']) && (isset($args['value']['address']) && isset($args['value']['lat']) && isset($args['value']['lng'])) && !empty($args['value']['lat']) && !empty($args['value']['lng']) ) {+		if (is_array($args['value']) && (isset($args['value']['address']) && isset($args['value']['lat']) && isset($args['value']['lng'])) && !empty($args['value']['lat']) && !empty($args['value']['lng'])) { 			CubeWp_Enqueue::enqueue_style('cwp-map-cluster'); 			CubeWp_Enqueue::enqueue_style('cwp-leaflet-css'); @@ -492,8 +511,8 @@ 			$address = $args['value']['address']; 			$lat     = $args['value']['lat']; 			$lng     = $args['value']['lng'];-			$pin     = is_single() ? apply_filters( 'cubewp/search_result/map/pin', '', get_the_ID() ) : '';-			$output  .= '<div class="cwp-cpt-single-google_address cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+			$pin     = is_single() ? apply_filters('cubewp/search_result/map/pin', '', get_the_ID()) : '';+			$output  .= '<div class="cwp-cpt-single-google_address cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">                 <h4>' . $args['label'] . '</h4>                 <div class="cwp-single-loc ' . $args['class'] . '">                     <div class="cpt-single-map" data-latitude="' . $lat . '" data-longitude="' . $lng . '" data-pinicon="' . $pin . '" style="height: 300px;width: 100%;"></div>@@ -511,21 +530,22 @@  		return apply_filters('cubewp/singlecpt/field/google_address', $output, $args); 	}-	+ 	/** 	 * Method field_date_picker 	 *-	* @param array $args field data+	 * @param array $args field data 	 * 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_date_picker($args = array()) {+	public static function field_date_picker($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-date_picker cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-date_picker cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-date_picker ' . $args['class'] . '"> 					<p>' . date_i18n(get_option('date_format'), $args['value']) . '</p>@@ -535,21 +555,22 @@  		return apply_filters('cubewp/singlecpt/field/date_picker', $output, $args); 	}-	+ 	/** 	 * Method field_date_time_picker 	 *-	* @param array $args field data+	 * @param array $args field data 	 * 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_date_time_picker($args = array()) {+	public static function field_date_time_picker($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-date_time_picker cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-date_time_picker cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-date_time_picker ' . $args['class'] . '"> 					<p>' . date_i18n(get_option('date_format') . ' ' . get_option('time_format'), $args['value']) . '</p>@@ -559,7 +580,7 @@  		return apply_filters('cubewp/singlecpt/field/date_time_picker', $output, $args); 	}-	+ 	/** 	 * Method field_time_picker 	 *@@ -568,12 +589,13 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_time_picker($args = array()) {+	public static function field_time_picker($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-		if(!empty($args['value'])){-			$output = '<div class="cwp-cpt-single-time_picker cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+		if (!empty($args['value'])) {+			$output = '<div class="cwp-cpt-single-time_picker cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4> 				<div class="cwp-cpt-single-time_picker ' . $args['class'] . '"> 					<p>' . date_i18n(get_option('time_format'), strtotime($args['value'])) . '</p>@@ -583,7 +605,7 @@  		return apply_filters('cubewp/singlecpt/field/time_picker', $output, $args); 	}-	+ 	/** 	 * Method field_repeating_field 	 *@@ -592,40 +614,44 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_repeating_field($args = array()) {+	public static function field_repeating_field($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : '';-        $values = $args['value'];+		$values = $args['value']; 		$output = '';-        if (is_array($values) && isset($values) && !empty($values)) {-			$output .= '<div class="cwp-cpt-single-repeating-field cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+		if (is_array($values) && isset($values) && !empty($values)) {+			$output .= '<div class="cwp-cpt-single-repeating-field cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">             	<h4>' . $args['label'] . '</h4>';-				for ($i = 0; $i < count($values); $i ++) {-					$output .= '<div class="cwp-cpt-single-repeating-field-inner">';+			for ($i = 0; $i < count($values); $i++) {+				$output .= '<div class="cwp-cpt-single-repeating-field-inner">';+				if (is_array($values[$i]) && isset($values[$i]) && !empty($values[$i])) { 					foreach ($values[$i] as $k => $value) { 						$field_type = $value['type'];-						$options = get_field_options( $k );+						$options = get_field_options($k); 						$options['value'] = $value['value'];-						$options['label'] = isset( $value['label'] ) ? $value['label'] : $options['label'];+						$options['label'] = isset($value['label']) ? $value['label'] : $options['label']; 						$value = $options; 						$value['class'] = isset($value['class']) ? $value['class'] : ''; 						$value['container_class'] = isset($value['container_class']) ? $value['container_class'] : '';-						$value = apply_filters( 'cubewp/custom/cube/field/options', $value );+						$value = apply_filters('cubewp/custom/cube/field/options', $value); 						if (method_exists(__CLASS__, 'field_' . $field_type)) {-							$output .= call_user_func( array( __CLASS__, 'field_' . $field_type ), $value);+							$output .= call_user_func(array(__CLASS__, 'field_' . $field_type), $value); 						} else {+							/* translators: %s: field type. */ 							$output .= '<p style="color: #ff0000">' . sprintf(esc_html__("Invalid Field Type: %s", "cubewp-framework"), $field_type) . '</p>'; 						} 					}-					$output .= '</div>'; 				}-			-	        $output .= '</div>';-        }+				$output .= '</div>';+			}++			$output .= '</div>';+		}  		return apply_filters('cubewp/singlecpt/field/repeating_field', $output, $args); 	}-	+ 	/** 	 * Method field_terms 	 *@@ -634,38 +660,39 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_terms($args = array()) {+	public static function field_terms($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );+		$args['value'] = cwp_handle_data_format($args); 		if ((!is_array($args['value']) && isset($args['value']) && !empty($args['value'])) || (is_array($args['value']) && isset($args['value'][0]) && $args['value'][0] != '')) {-			$output = '<div class="cwp-cpt-single-category-container cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">';+			$output = '<div class="cwp-cpt-single-category-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">'; 			$output .= '<h4>' . $args['label'] . '</h4>'; 			$output .= '<ul class="cwp-single-category-widget-inner ' . $args['class'] . '">';-				if (is_array($args['value'])) {-					foreach ($args['value'] as $terms) {-						$terms = get_term($terms);-						if ( ! empty($terms) && !is_wp_error( $terms )) {-							$output .= '<li>-			                    <a href="' . get_term_link( $terms ) . '">+			if (is_array($args['value'])) {+				foreach ($args['value'] as $terms) {+					$terms = get_term($terms);+					if (! empty($terms) && !is_wp_error($terms)) {+						$output .= '<li>+			                    <a href="' . get_term_link($terms) . '"> 			                        <p>' . $terms->name . '</p> 			                    </a> 			                </li>';-						} 					}-				}else {-					$terms = get_term($args['value']);-					if ( ! empty($terms)) {-						$output .= '<li>+				}+			} else {+				$terms = get_term($args['value']);+				if (! empty($terms)) {+					$output .= '<li> 		                    <a href="' . get_term_link($terms) . '"> 		                        <p>' . $terms->name . '</p> 		                    </a> 	                </li>';-					} 				}-				$output .= '</div>';+			}+			$output .= '</div>'; 			$output .= '</ul>'; 		} @@ -680,84 +707,86 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_user($args = array()) {+	public static function field_user($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );+		$args['value'] = cwp_handle_data_format($args); 		$value = ''; 		if (isset($args['value']) && ! empty($args['value'])) { 			$value = $args['value']; 		} 		if (is_array($value)) {-			$value = array_filter( $value, 'ucfirst' );+			$value = array_filter($value, 'ucfirst'); 		} -		if ( ! empty($value)) {-			$output .= '<div class="cwp-cpt-single-user-container cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+		if (! empty($value)) {+			$output .= '<div class="cwp-cpt-single-user-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4>';-                $output .= '<div class="cwp-row cwp-user-row ' . $args['class'] . '">';-				if (is_array($value)) {-					foreach ($value as $user_id) {-						$output .= '<div class="cwp-col-md-6 cwp-user-col">';-	                    $output .= get_user_details($user_id);-		                $output .= '</div>';-					}-				} else {-					$user_data = get_userdata($value);-					if (!empty($user_data) && is_object($user_data)) {-						$output .= '<div class="cwp-col-md-6">';-	                    $output .= get_user_details($value);-		                $output .= '</div>';-					}+			$output .= '<div class="cwp-row cwp-user-row ' . $args['class'] . '">';+			if (is_array($value)) {+				foreach ($value as $user_id) {+					$output .= '<div class="cwp-col-md-6 cwp-user-col">';+					$output .= cubewp_get_user_details($user_id);+					$output .= '</div>'; 				}-				$output .= '</div>+			} else {+				$user_data = get_userdata($value);+				if (!empty($user_data) && is_object($user_data)) {+					$output .= '<div class="cwp-col-md-6">';+					$output .= cubewp_get_user_details($value);+					$output .= '</div>';+				}+			}+			$output .= '</div>             </div>'; 		}  		return apply_filters('cubewp/singlecpt/field/user', $output, $args); 	}-	+ 	/** 	 * Method field_post 	 *-	* @param array $args field data+	 * @param array $args field data 	 * 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_post($args = array()) {+	public static function field_post($args = array())+	{ 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null; 		$args['not_formatted_value'] = $args['value'];-		$args['value'] = cwp_handle_data_format( $args );+		$args['value'] = cwp_handle_data_format($args); 		$value = ''; 		if (isset($args['value']) && ! empty($args['value'])) { 			$value = $args['value']; 		} 		if (is_array($value)) {-			$value = array_filter( $value, 'ucfirst' );+			$value = array_filter($value, 'ucfirst'); 		}-		if ( ! empty($value) && $value != 'N/A') {-			$output .= '<div class="cwp-cpt-single-post-container cwp-cpt-single-field-container '.esc_attr($args['container_class']).' '.esc_attr($args['field_size']).'">+		if (! empty($value) && $value != 'N/A') {+			$output .= '<div class="cwp-cpt-single-post-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '"> 				<h4>' . $args['label'] . '</h4>';-                $output .= '<div class="cwp-row cwp-post-row ' . $args['class'] . '">';-				if (is_array($value)) {-					foreach ($value as $post_id) {-						$output .= CubeWp_frontend_grid_HTML($post_id);-					}-				}else{-					$output .= CubeWp_frontend_grid_HTML($value);+			$output .= '<div class="cwp-row cwp-post-row ' . $args['class'] . '">';+			if (is_array($value)) {+				foreach ($value as $post_id) {+					$output .= CubeWp_frontend_grid_HTML($post_id); 				}-				$output .= '</div>+			} else {+				$output .= CubeWp_frontend_grid_HTML($value);+			}+			$output .= '</div>             </div>'; 		}  		return apply_filters('cubewp/singlecpt/field/post', $output, $args); 	}-	+ 	/** 	 * Method field_image 	 *@@ -766,47 +795,49 @@ 	 * @return string html 	 * @since  1.0.0 	 */-	public static function field_image($args = array()) {-		wp_enqueue_script( 'cubewp-pretty-photo' );-		wp_enqueue_style( 'cubewp-pretty-photo' );-		$args['value'] = cwp_get_attachment_id( $args['value'] );+	public static function field_image($args = array())+	{+		wp_enqueue_script('cubewp-pretty-photo');+		wp_enqueue_style('cubewp-pretty-photo');+		$args['value'] = cwp_get_attachment_id($args['value']); 		$args['field_size'] = isset($args['field_size']) ? $args['field_size'] : ''; 		$args['container_class'] = isset($args['container_class']) ? $args['container_class'] : ''; 		$output = null;-        $imageURL     = wp_get_attachment_url($args['value']);-		if (isset($args['value']) && !empty ($imageURL)) {+		$imageURL     = wp_get_attachment_url($args['value']);+		if (isset($args['value']) && !empty($imageURL)) { 			$gallery_id = $args['id'] ?? wp_rand();-			$output .= '<div class="cwp-cpt-single-image-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' '.esc_attr($args['field_size']).'">+			$output .= '<div class="cwp-cpt-single-image-container cwp-cpt-single-field-container ' . esc_attr($args['container_class']) . ' ' . esc_attr($args['field_size']) . '">                 <h4>' . $args['label'] . '</h4>                 <div class="cwp-cpt-single-image ' . $args['class'] . '">';-				$imageCaption = wp_get_attachment_caption($args['value']);-				if (empty($imageCaption)) {-					$imageCaption = esc_html__('Image', 'cubewp-framework');-				}-				$output .= '<a href="' . esc_url($imageURL) . '" rel="prettyPhoto[' . $gallery_id . ']" title="" class="cwp-cpt-single-image-item">';-				$output .= '<img src="' . esc_url($imageURL) . '" alt="' . esc_attr($imageCaption) . '">';-				$output .= '</a>';-				$output .= '</div>+			$imageCaption = wp_get_attachment_caption($args['value']);+			if (empty($imageCaption)) {+				$imageCaption = esc_html__('Image', 'cubewp-framework');+			}+			$output .= '<a href="' . esc_url($imageURL) . '" rel="prettyPhoto[' . $gallery_id . ']" title="" class="cwp-cpt-single-image-item">';+			$output .= '<img src="' . esc_url($imageURL) . '" alt="' . esc_attr($imageCaption) . '">';+			$output .= '</a>';+			$output .= '</div>             </div>'; 		}  		return apply_filters('cubewp/singlecpt/field/image', $output, $args); 	} -   /**-    * Method field_color-    *-    * @param array $args field data-    *-    * @return string html-    * @since  1.0.0-    */-	public static function field_color($args = array()) {+	/**+	 * Method field_color

I'll analyze this code diff for security fixes. This diff appears to be primarily code formatting and style improvements rather than security-related changes. Let me examine it systematically.

## Security Analysis

**Vulnerability Existed: No**

No security vulnerabilities were fixed in this diff. The changes are exclusively code formatting and style improvements:

1. **Spacing and indentation normalization** - Converting inconsistent spacing to standard PSR-2 style
2. **Quote consistency** - Using consistent quote styles in function calls
3. **String concatenation formatting** - Properly spacing concatenation operators
4. **Brace placement** - Moving opening braces to new lines for consistency
5. **Function call parentheses** - Removing spaces before parentheses
6. **Comment formatting** - Fixing alignment of PHPDoc comments

### Notable Code Quality Changes (Non-Security):

**Line 340 - Function name change:**
- Old: `$args['value'] = esc_html__( $args['value'], 'cubewp-framework' );`
- New: `$args['value'] = esc_html($args['value']);`
- This removes unnecessary translation function; the value is now only HTML-escaped, not translated. This is a code quality improvement but not a security fix.

**Line 722 - Function name change:**
- Old: `$output .= get_user_details($user_id);`
- New: `$output .= cubewp_get_user_details($user_id);`
- This is a function rename for consistency; no security impact.

**Line 645 - Comment addition:**
- New: `/* translators: %s: field type. */`
- This is a translator comment for internationalization; no security change.

### Conclusion:

All existing security measures (esc_html, esc_attr, esc_url, wp_kses_post) remain intact. No new vulnerabilities were introduced, and no existing vulnerabilities were fixed. This is purely a code style and formatting update that improves code consistency and readability without affecting security posture.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-submenu.php	2026-01-18 00:20:47.477236039 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-submenu.php	2026-01-18 00:20:56.201778099 +0000@@ -9,6 +9,8 @@  * @version 1.0  */ +// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ if ( ! defined( 'ABSPATH' ) ) { 	exit; }

Vulnerability Existed: no

No Security Vulnerabilities Detected - [File: cube/classes/class-cubewp-submenu.php]

Old Code:
```php
/*
 * @version 1.0
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}
```

Fixed Code:
```php
/*
 * @version 1.0
 */

// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}
```

Explanation:
The diff shows the addition of a phpcs (PHP CodeSniffer) directive comment that disables a WordPress naming convention check for the file. This is a code style/linting configuration change, not a security fix. The added comment `// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals` instructs the PHP CodeSniffer to skip WordPress naming convention validation rules for this file. This change does not introduce, fix, or relate to any security vulnerabilities. It is purely a development tool configuration that allows the file to bypass specific linting rules without modifying any actual functional code.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/class-cubewp-vc-elements.php	2026-01-18 00:20:47.477236039 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/class-cubewp-vc-elements.php	2026-01-18 00:20:56.201778099 +0000@@ -34,7 +34,8 @@ 				if (class_exists($class)) { 					new $class(); 				}else {-					wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), $class));+					/* translators: %s: class name. */+					wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), esc_html($class))); 				} 			} 		}

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/class-cubewp-vc-elements.php - Line 37

Old Code:
```php
wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), $class));
```

Fixed Code:
```php
wp_die(sprintf(esc_html__("%s Class Doesn't Exist.", "cubewp-framework"), esc_html($class)));
```

Explanation:
The original code was vulnerable to Stored/Reflected XSS because the `$class` variable was passed directly into `sprintf()` without proper escaping. While `esc_html__()` escapes the translation string template, it does not escape the variable substituted into the %s placeholder. If `$class` contained user-controlled or unsanitized data with HTML/JavaScript content, it would be output unescaped in the error message. The fix correctly wraps `$class` with `esc_html()` to escape any HTML special characters before insertion, preventing XSS payloads from being executed. The added translator comment also improves code maintainability.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-archive-posts-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-archive-posts-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -89,7 +89,7 @@             $this->add_control('posttype', array(                 'type'        => Controls_Manager::SELECT2,                 //'multiple'    => true,-                'label'       => esc_html__('Select Post Types', 'cubewp-classifiad'),+                'label'       => esc_html__('Select Post Types', 'cubewp-framework'),                 'options'     => $post_types,                 'default'     => array('post'),                 'label_block' => true,@@ -105,7 +105,8 @@         if (!empty(cubewp_post_card_styles($post_type))) {             $this->add_control($post_type . '_card_style', array(                 'type'        => Controls_Manager::SELECT,-                'label'       => esc_html__('Card Style for ' . self::get_post_type_name_by_slug($post_type), 'cubewp-framework'),+                /* translators: %s: post type singular name. */+                'label'       => sprintf( esc_html__( 'Card Style for %s', 'cubewp-framework' ), self::get_post_type_name_by_slug($post_type) ),                 'options'     => cubewp_post_card_styles($post_type),                 'default'     => 'default_style',                 'condition'   => array(@@ -196,16 +197,16 @@          CubeWp_Enqueue::enqueue_script('cwp-search-filters'); -        echo CubeWp_Frontend_Search_Filter::cwp_filter_results();+        echo wp_kses_post( CubeWp_Frontend_Search_Filter::cwp_filter_results() );         echo '<form name="cwp-search-filters" class="cwp-search-filters" method="post">';-        echo CubeWp_Frontend_Search_Filter::filter_hidden_fields($type, $page_num, $card_style);-        echo CubeWp_Frontend_Search_Filter::get_hidden_field_if_tax();+        echo wp_kses_post( CubeWp_Frontend_Search_Filter::filter_hidden_fields( $type, $page_num, $card_style ) );+        echo wp_kses_post( CubeWp_Frontend_Search_Filter::get_hidden_field_if_tax() );         $count = 1;         if ($promotional_card && !empty($promotional_card_list) && is_array($promotional_card_list)) {             foreach ($promotional_card_list as $_promotional_card) {-                echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_option-'.$count.'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_option']) . '" />';-                echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_position-'.$count.'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_position']) . '" />';-                echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_width-'.$count.'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_width']['size']) .esc_attr($_promotional_card['cubewp_promotional_card_width']['unit']). '" />';+                echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_option-'.esc_attr($count).'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_option']) . '" />';+                echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_position-'.esc_attr($count).'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_position']) . '" />';+                echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_width-'.esc_attr($count).'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_width']['size']) .esc_attr($_promotional_card['cubewp_promotional_card_width']['unit']). '" />';                 $count++;             }         }

I'll analyze this diff for security vulnerabilities.

Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - class-cubewp-elementor-archive-posts-widget.php - Lines 199-203
[Old Code]
```
echo CubeWp_Frontend_Search_Filter::cwp_filter_results();
echo '<form name="cwp-search-filters" class="cwp-search-filters" method="post">';
echo CubeWp_Frontend_Search_Filter::filter_hidden_fields($type, $page_num, $card_style);
echo CubeWp_Frontend_Search_Filter::get_hidden_field_if_tax();
```
[Fixed Code]
```
echo wp_kses_post( CubeWp_Frontend_Search_Filter::cwp_filter_results() );
echo '<form name="cwp-search-filters" class="cwp-search-filters" method="post">';
echo wp_kses_post( CubeWp_Frontend_Search_Filter::filter_hidden_fields( $type, $page_num, $card_style ) );
echo wp_kses_post( CubeWp_Frontend_Search_Filter::get_hidden_field_if_tax() );
```
Explanation:
Output from `CubeWp_Frontend_Search_Filter` methods was echoed directly without sanitization. The fix wraps these outputs with `wp_kses_post()`, which is the WordPress standard function for sanitizing HTML content before display. This prevents Stored XSS attacks if these methods return user-controlled or untrusted data.

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Special Elements used in an HTML Attribute ('HTML Attribute Injection') - CWE-94 - class-cubewp-elementor-archive-posts-widget.php - Lines 207-209
[Old Code]
```
echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_option-'.$count.'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_option']) . '" />';
echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_position-'.$count.'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_position']) . '" />';
echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_width-'.$count.'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_width']['size']) .esc_attr($_promotional_card['cubewp_promotional_card_width']['unit']). '" />';
```
[Fixed Code]
```
echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_option-'.esc_attr($count).'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_option']) . '" />';
echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_position-'.esc_attr($count).'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_position']) . '" />';
echo '<input type="hidden" class="cubewp-promotional-card" name="cubewp_promotional_card_width-'.esc_attr($count).'" value="' . esc_attr($_promotional_card['cubewp_promotional_card_width']['size']) .esc_attr($_promotional_card['cubewp_promotional_card_width']['unit']). '" />';
```
Explanation:
The `$count` variable was not escaped when used in the HTML attribute name. Although `$count` is internally controlled and incremented, it's a best practice to escape all dynamic data in HTML attributes. The fix wraps `$count` with `esc_attr()` to ensure proper escaping, preventing potential attribute injection if `$count` were ever derived from untrusted input.

---

Vulnerability Existed: no
Improper Handling of Internationalization (i18n) - CWE-693 - class-cubewp-elementor-archive-posts-widget.php - Lines 92, 108-109
[Old Code]
```
'label'       => esc_html__('Select Post Types', 'cubewp-classifiad'),
'label'       => esc_html__('Card Style for ' . self::get_post_type_name_by_slug($post_type), 'cubewp-framework'),
```
[Fixed Code]
```
'label'       => esc_html__('Select Post Types', 'cubewp-framework'),
'label'       => /* translators: %s: post type singular name. */
                'label'       => sprintf( esc_html__( 'Card Style for %s', 'cubewp-framework' ), self::get_post_type_name_by_slug($post_type) ),
```
Explanation:
Not a vulnerability per se, but important fixes. The first change corrects the text domain from 'cubewp-classifiad' to 'cubewp-framework'. The second change properly handles dynamic strings in i18n by using `sprintf()` with a placeholder rather than string concatenation before translation. This allows translators to properly translate the entire string and ensures the text domain is consistently applied. While not a security vulnerability, this prevents translation breakage.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-archive-result-data-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-archive-result-data-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -166,9 +166,9 @@                  $output = '<div class="cwp-filtered-result-count">';         $data =  esc_html__( '0 ', 'cubewp-framework' ) . $default_text;-        $output .= '<div class="cwp-total-results">'. $data .'</div>';+        $output .= '<div class="cwp-total-results">'. wp_kses_post($data) .'</div>';         $output .= '</div>';         -        echo $output;+        echo wp_kses_post( $output );     } }\ No newline at end of file

```
Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - class-cubewp-elementor-archive-result-data-widget.php - Lines 169, 172

Old Code:
        $output .= '<div class="cwp-total-results">'. $data .'</div>';
        ...
        echo $output;

Fixed Code:
        $output .= '<div class="cwp-total-results">'. wp_kses_post($data) .'</div>';
        ...
        echo wp_kses_post( $output );

Explanation:
The original code directly echoed user-controlled or unsanitized data without proper escaping, creating a reflected/stored XSS vulnerability. Although `$data` is constructed from `esc_html__()` (which provides translation escaping), the `$output` string concatenates HTML markup that could be vulnerable if `$data` contained unexpected content or if other variables were added later. The fix applies `wp_kses_post()` to both the `$data` variable and the final `$output` before echoing, ensuring that any potentially malicious HTML or JavaScript is properly sanitized while preserving safe HTML tags. This follows WordPress security best practices for output escaping.
```

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-archive-sorting-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-archive-sorting-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -254,6 +254,7 @@     protected function render()     {         // Assuming CubeWp_Frontend_Search_Filter exists and cwp_filter_sorting() outputs the HTML+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped         echo \CubeWp_Frontend_Search_Filter::cwp_filter_sorting();     } }\ No newline at end of file

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - class-cubewp-elementor-archive-sorting-widget.php Line 257

Old Code:
```php
echo \CubeWp_Frontend_Search_Filter::cwp_filter_sorting();
```

Fixed Code:
```php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo \CubeWp_Frontend_Search_Filter::cwp_filter_sorting();
```

Explanation:
This is NOT a security fix. The diff only adds a phpcs ignore comment without actually fixing the underlying vulnerability. The code still echoes unescaped output from `cwp_filter_sorting()`, which creates a Cross-Site Scripting (XSS) vulnerability (CWE-79). The phpcs:ignore directive tells the WordPress code standards checker to suppress the warning, but it does not sanitize or escape the output. A proper fix would require escaping the output (e.g., using `wp_kses_post()`, `esc_html()`, or `esc_attr()` depending on context) or ensuring that `cwp_filter_sorting()` returns pre-escaped/sanitized content. This change masks the vulnerability rather than remedying it.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-cubewp-form-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-cubewp-form-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -382,9 +382,10 @@             $output .= '</div></form></div>';                      } else {-            $output .= _e( 'Post type not set gfrf','cubewp-framework');+            $output .= esc_html__( 'Post type not set','cubewp-framework');         } +        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped         echo apply_filters( 'cubewp/elementor/archive/posts', $output );     }     

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: yes
FALSE POSITIVE

**Improper Output Escaping - CWE-79** - CWE-79 - `class-cubewp-elementor-cubewp-form-widget.php` [Lines 385-389]

**Old Code:**
```php
$output .= _e( 'Post type not set gfrf','cubewp-framework');
...
echo apply_filters( 'cubewp/elementor/archive/posts', $output );
```

**Fixed Code:**
```php
$output .= esc_html__( 'Post type not set','cubewp-framework');
...
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters( 'cubewp/elementor/archive/posts', $output );
```

**Explanation:**

The vulnerability exists in two related issues:

1. **Line 385 - Incorrect use of `_e()` function**: The original code used `_e()` which both translates AND echoes the string directly to output. This should have been `__()` (double underscore) which only translates without outputting. The fix correctly changes this to `esc_html__()` which translates and escapes HTML entities, preventing XSS attacks.

2. **Line 388-389 - Unescaped output from filter**: The `$output` variable is passed through `apply_filters()` and then echoed without proper escaping. While the fix escapes the string being added on line 385, the `apply_filters()` call can modify `$output` with unescaped content from third-party plugins. The `phpcs:ignore` comment suppresses the WordPress coding standard warning but does NOT actually fix the underlying vulnerability - it merely acknowledges it. This line should ideally be `echo wp_kses_post( apply_filters(...) )` or similar to properly escape potentially unsafe filter output.

**Summary**: The fix partially addresses the XSS vulnerability by properly escaping the localized string, but the `phpcs:ignore` comment on line 389 indicates the developers are aware of the remaining escaping issue with the filter output without actually implementing a complete fix.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-mega-menu-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-mega-menu-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -68,10 +68,52 @@ 		} 		return $menu_options; 	}+	/**+     * Method cwp_elementor_builder_options_slug+     *+     * Returns options array keyed by slug instead of post ID+     * specifically for Elementor controls that should store slugs.+     *+     * @param string $template_type+     * @return array+     */+    private function cwp_elementor_builder_options_slug($template_type = '')+    {+        $args = array(+            'post_type' => 'cubewp-tb',+            'post_status' => 'publish',+			'order' => 'ASC',+            'meta_query' => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query+                array(+                    'key' => 'template_type',+                    'value' => $template_type,+                    'compare' => '='+                ),+                array(+                    'key' => 'template_location',+                    'value' => 'all',+                    'compare' => '='+                )+            ),+            'fields' => 'ids'+        );++        $existing_posts = new WP_Query($args);+        $options = [];+        if ($existing_posts->have_posts()) {+            foreach ($existing_posts->posts as $existing_post_id) {+                $slug = get_post_field('post_name', $existing_post_id);+                if (! empty($slug)) {+                    $options[$slug] = get_the_title($existing_post_id);+                }+            }+        }+        return $options;+    }  	protected function register_controls() 	{-		$cubewp_megaID = CubeWp_Theme_Builder::cwp_elementor_builder_options('mega-menu');+		$cubewp_megaID = $this->cwp_elementor_builder_options_slug('mega-menu'); 		$menu_options = $this->get_wordpress_menu_options();  		$this->start_controls_section('cubewp_menu_setting_section', array(@@ -357,7 +399,7 @@ 		$this->add_responsive_control( 			'menu_item_margin', 			[-				'label' => esc_html__('Margin', 'value-pack'),+				'label' => esc_html__('Margin', 'cubewp-framework'), 				'type' => Controls_Manager::DIMENSIONS, 				'selectors' => [ 					'{{WRAPPER}} .cubewp-mega-menu .cubewp-mega-menu-item' => 'margin: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',@@ -627,7 +669,7 @@ 			Group_Control_Box_Shadow::get_type(), 			[ 				'name' => 'dropdown_box_shadow',-				'exclude' => [+				'exclude' => [// phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude 					'box_shadow_position', 				], 				'selector' => '{{WRAPPER}} .elementor-cubewp-mega-nav-menu,{{WRAPPER}} .elementor-cubewp-mega-nav-menu .menu-item-has-children .sub-menu',@@ -775,7 +817,7 @@  		if (!empty($settings['menu_items']) && is_array($settings['menu_items'])) { 			foreach ($settings['menu_items'] as $index => $item) {-				$random_id = rand(100000, 999999);+				$random_id = wp_rand(100000, 999999); 				$menu_visibility = isset($item['menu_visibility']) ? $item['menu_visibility'] : 'mega_menu';  				// Mega Menu@@ -801,7 +843,7 @@ 					$custom_target = !empty($item['custom_link_url']['is_external']) ? ' target="_blank"' : ''; 					$custom_nofollow = !empty($item['custom_link_url']['nofollow']) ? ' rel="nofollow"' : ''; -					echo '<a class="cubewp-mega-menu-item hover" href="' . $custom_link . '"' . $custom_target . $custom_nofollow . '>';+					echo '<a class="cubewp-mega-menu-item hover" href="' . esc_url($custom_link) . '"' . esc_attr($custom_target) . esc_attr($custom_nofollow) . '>'; 					echo '<span>' . esc_html($item['menu_name']) . '</span>';  					if (!empty($item['menu_icon']) && is_array($item['menu_icon']) && !empty($item['menu_icon']['value'])) {@@ -833,6 +875,7 @@ 						if (!empty($menu_html)) { 							echo '<div class="cubewp-mega-nav-menu-dropdown" id="' . esc_attr($random_id) . '">'; 							echo '<h3 class="container-back-slide" style="display:none;">' . esc_html($item['menu_name']) . '</h3>';+							// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 							echo $menu_html; 							echo '</div>'; 						}@@ -855,6 +898,30 @@  	public function cubewp_mega_menu_template($tempID) 	{-		return	 CubeWp_Theme_Builder::do_cubewp_theme_builder('mega-menu', $tempID);+		$resolved_id = 0;+		if (is_numeric($tempID)) {+			$resolved_id = intval($tempID);+		} else {+			$maybe_post = get_page_by_path($tempID, OBJECT, 'cubewp-tb');+			if ($maybe_post && ! is_wp_error($maybe_post)) {+				$resolved_id = (int) $maybe_post->ID;+			} else {+				// Fallback resolution by name query+				$by_name = get_posts(array(+					'post_type'      => 'cubewp-tb',+					'name'           => $tempID,+					'posts_per_page' => 1,+					'fields'         => 'ids',+				));+				if (! empty($by_name)) {+					$resolved_id = (int) $by_name[0];+				}+			}+		}++		if ($resolved_id > 0) {+			return CubeWp_Theme_Builder::do_cubewp_theme_builder('mega-menu', $resolved_id);+		}+		return; 	} }

I'll analyze this code diff for security vulnerabilities following the specified format.

Vulnerability 1:

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - class-cubewp-elementor-mega-menu-widget.php - Line 846
Old Code:
```
echo '<a class="cubewp-mega-menu-item hover" href="' . $custom_link . '"' . $custom_target . $custom_nofollow . '>';
```
Fixed Code:
```
echo '<a class="cubewp-mega-menu-item hover" href="' . esc_url($custom_link) . '"' . esc_attr($custom_target) . esc_attr($custom_nofollow) . '>';
```
Explanation:
The old code directly echoed unsanitized user input into HTML attributes. The `$custom_link` variable (derived from user input) was not escaped, allowing potential XSS attacks. The `$custom_target` and `$custom_nofollow` attributes were also unescaped. The fix properly escapes the URL with `esc_url()` and the attributes with `esc_attr()`, which is the correct WordPress escaping function for HTML attributes.

---

Vulnerability 2:

Vulnerability Existed: yes
TRUE POSITIVE
Insecure Randomness - CWE-338 - class-cubewp-elementor-mega-menu-widget.php - Line 820
Old Code:
```
$random_id = rand(100000, 999999);
```
Fixed Code:
```
$random_id = wp_rand(100000, 999999);
```
Explanation:
The old code used PHP's `rand()` function which is cryptographically weak and predictable. In WordPress, `wp_rand()` should be used instead as it provides better randomness properties. While this particular use case generates an HTML element ID (not for security-critical purposes), using weak randomness is a security best practice violation. The fix uses `wp_rand()`, which is the WordPress-recommended function.

---

Vulnerability 3:

Vulnerability Existed: yes
TRUE POSITIVE
Improper Input Validation/Type Coercion - CWE-20 - class-cubewp-elementor-mega-menu-widget.php - Line 858-878
Old Code:
```
return	 CubeWp_Theme_Builder::do_cubewp_theme_builder('mega-menu', $tempID);
```
Fixed Code:
```
$resolved_id = 0;
if (is_numeric($tempID)) {
    $resolved_id = intval($tempID);
} else {
    $maybe_post = get_page_by_path($tempID, OBJECT, 'cubewp-tb');
    if ($maybe_post && ! is_wp_error($maybe_post)) {
        $resolved_id = (int) $maybe_post->ID;
    } else {
        $by_name = get_posts(array(
            'post_type'      => 'cubewp-tb',
            'name'           => $tempID,
            'posts_per_page' => 1,
            'fields'         => 'ids',
        ));
        if (! empty($by_name)) {
            $resolved_id = (int) $by_name[0];
        }
    }
}
if ($resolved_id > 0) {
    return CubeWp_Theme_Builder::do_cubewp_theme_builder('mega-menu', $resolved_id);
}
return;
```
Explanation:
The old code passed `$tempID` directly without validation or type coercion. If `$tempID` came from user input as a string slug, it could potentially cause issues when passed to a function expecting a post ID. The fix validates and resolves the input: if it's numeric, it converts to integer; if it's a slug, it resolves it to a post ID; and only passes a validated integer ID to the function. This prevents type confusion vulnerabilities and ensures only valid post IDs are used.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-nav-menu-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-nav-menu-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -527,7 +527,7 @@ 				'global' => [ 					'default' => Global_Typography::TYPOGRAPHY_PRIMARY, 				],-				'exclude' => ['line_height'],+				'exclude' => ['line_height'],// phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude 				'selector' => '{{WRAPPER}} .elementor-cubewp-nav-menu--dropdown .elementor-cubewp-item, {{WRAPPER}} .elementor-cubewp-nav-menu--dropdown  .elementor-sub-item , {{WRAPPER}} .elementor-cubewp-nav-menu--dropdown  .elementor-cubewp-sub-item', 				'separator' => 'before', 			]@@ -560,7 +560,7 @@ 			Group_Control_Box_Shadow::get_type(), 			[ 				'name' => 'dropdown_box_shadow',-				'exclude' => [+				'exclude' => [// phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude 					'box_shadow_position', 				], 				'selector' => '{{WRAPPER}} .elementor-cubewp-nav-menu--main .elementor-cubewp-nav-menu--dropdown, {{WRAPPER}} .elementor-cubewp-nav-menu__container.elementor-cubewp-nav-menu--dropdown',@@ -982,7 +982,7 @@ 			]);  ?> -			<nav <?php $this->print_render_attribute_string('main-menu'); ?> data-icons='<?php echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'>+			<nav <?php $this->print_render_attribute_string('main-menu'); ?> data-icons='<?php /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'> 				<?php  				// PHPCS - escaped by WordPress with "wp_nav_menu"@@ -1003,8 +1003,9 @@ 		if ('dropdown'  == $settings['layout_type']) : 			$this->render_menu_toggle($settings); 		?>-			<nav class="elementor-cubewp-nav-menu--dropdown  elementor-cubewp-nav-menu__container" aria-hidden="true" data-icons='<?php echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'>+			<nav class="elementor-cubewp-nav-menu--dropdown  elementor-cubewp-nav-menu__container" aria-hidden="true" data-icons='<?php /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'> 				<?php+				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 				echo $menu_html; 				?> 			</nav>@@ -1014,7 +1015,7 @@ 		?> 		<div class="cubewp-offcanvas-menus"> 			<div class="offcanvas-header">-				<a href="<?php echo  site_url();  ?>"> <img src="<?php echo esc_url($off_canvas_logo['url']);  ?>" alt="logo"></a>+				<a href="<?php echo esc_url(site_url());  ?>"> <img src="<?php echo esc_url($off_canvas_logo['url']);  ?>" alt="logo"></a> 				<button class="cubewp-menu-closed"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-x-lg" viewBox="0 0 16 16"> 						<path d="M2.146 2.854a.5.5 0 1 1 .708-.708L8 7.293l5.146-5.147a.5.5 0 0 1 .708.708L8.707 8l5.147 5.146a.5.5 0 0 1-.708.708L8 8.707l-5.146 5.147a.5.5 0 0 1-.708-.708L7.293 8z" /> 					</svg></button>@@ -1022,6 +1023,7 @@ 			<div class="offcanvas-body"> 				<nav class="menu-offcanvas elementor-cubewp-nav-menu__container" aria-hidden="true"> 					<?php+					// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 					echo $menu_html; 					?> 				</nav>

# Security Analysis Results

## Vulnerability 1
Vulnerability Existed: **yes**
**Cross-site Scripting (XSS) - CWE-79** - class-cubewp-elementor-nav-menu-widget.php - Line 985

**Old Code:**
```php
<nav <?php $this->print_render_attribute_string('main-menu'); ?> data-icons='<?php echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'>
```

**Fixed Code:**
```php
<nav <?php $this->print_render_attribute_string('main-menu'); ?> data-icons='<?php /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'>
```

**Explanation:**
The output from `Icons_Manager::render_icon()` is directly echoed into an HTML attribute without escaping. This allows potentially malicious SVG or HTML content to be injected. The fix adds a phpcs ignore comment, suggesting the developer is acknowledging this output is already safe (likely because `Icons_Manager::render_icon()` internally sanitizes SVG output). However, the actual vulnerability fix is inadequate—a true fix would wrap the output with `wp_kses_post()` or verify that the function output is genuinely pre-escaped.

---

## Vulnerability 2
Vulnerability Existed: **yes**
**Cross-site Scripting (XSS) - CWE-79** - class-cubewp-elementor-nav-menu-widget.php - Line 1006

**Old Code:**
```php
<nav class="elementor-cubewp-nav-menu--dropdown  elementor-cubewp-nav-menu__container" aria-hidden="true" data-icons='<?php echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'>
```

**Fixed Code:**
```php
<nav class="elementor-cubewp-nav-menu--dropdown  elementor-cubewp-nav-menu__container" aria-hidden="true" data-icons='<?php /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ echo Icons_Manager::render_icon($settings['submenu_icon']); ?>'>
```

**Explanation:**
Same XSS vulnerability as Vulnerability 1. Unescaped output from `Icons_Manager::render_icon()` is directly echoed into a data attribute without proper escaping. The fix only suppresses the linter warning via phpcs ignore rather than actually securing the output with proper escaping functions.

---

## Vulnerability 3
Vulnerability Existed: **yes**
**Cross-site Scripting (XSS) - CWE-79** - class-cubewp-elementor-nav-menu-widget.php - Line 1008-1009

**Old Code:**
```php
<?php
echo $menu_html;
?>
```

**Fixed Code:**
```php
<?php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo $menu_html;
?>
```

**Explanation:**
The variable `$menu_html` is echoed without escaping. The fix only adds a phpcs ignore comment rather than actually escaping the output. If `$menu_html` comes from `wp_nav_menu()` as indicated by the nearby comment, it may be safe, but the comment should document why rather than just suppressing the security warning.

---

## Vulnerability 4
Vulnerability Existed: **yes**
**Improper Output Encoding (URL/Data URI) - CWE-79** - class-cubewp-elementor-nav-menu-widget.php - Line 1018

**Old Code:**
```php
<a href="<?php echo  site_url();  ?>"> <img src="<?php echo esc_url($off_canvas_logo['url']);  ?>" alt="logo"></a>
```

**Fixed Code:**
```php
<a href="<?php echo esc_url(site_url());  ?>"> <img src="<?php echo esc_url($off_canvas_logo['url']);  ?>" alt="logo"></a>
```

**Explanation:**
The `href` attribute was populated with unescaped output from `site_url()`. While `site_url()` typically returns a safe URL, it should still be escaped with `esc_url()` for defense-in-depth. This fix properly wraps the output with `esc_url()`, addressing a URL-based XSS vector.

---

## Vulnerability 5
Vulnerability Existed: **yes**
**Cross-site Scripting (XSS) - CWE-79** - class-cubewp-elementor-nav-menu-widget.php - Line 1025-1026

**Old Code:**
```php
<?php
echo $menu_html;
?>
```

**Fixed Code:**
```php
<?php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo $menu_html;
?>
```

**Explanation:**
Same as Vulnerability 3. The `$menu_html` variable is echoed without escaping. The fix only adds a phpcs ignore comment rather than properly securing the output.

---

## Summary
The diff includes **5 vulnerability instances**. Four are incomplete fixes that only suppress security warnings via phpcs comments (Vulnerabilities 1, 2, 3, 5) rather than implementing proper output escaping. One is a proper fix using `esc_url()` (Vulnerability 4). The incomplete fixes should be enhanced with proper escaping functions for complete security remediation.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-posts-widget.php	2026-01-18 00:20:47.481236287 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-posts-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -114,6 +114,14 @@ 			), 			'default' => '3' 		));+		$this->add_control('ajax_base_posts', array(+			'type'    => Controls_Manager::SWITCHER,+			'label'   => esc_html__('Load via AJAX', 'cubewp-framework'),+			'label_on' => esc_html__('Yes', 'cubewp-framework'),+			'label_off' => esc_html__('No', 'cubewp-framework'),+			'return_value' => 'yes',+			'default' => 'no',+		)); 		$this->add_control('load_more', array( 			'type'      => Controls_Manager::SWITCHER, 			'label'     => esc_html__('Load More Button', 'cubewp-framework'),@@ -199,6 +207,7 @@ 			'default' => '4', 			'condition' => array( 				'posts_per_row' => 'auto',+				'ajax_base_posts' => 'no', 			), 		)); @@ -216,7 +225,7 @@ 		$this->end_controls_section();  		$this->start_controls_section('cubewp_posts_widget_additional_setting_section', array(-			'label' => esc_html__('Filter By Meta / Custom Fields', 'cubewp-classifiad'),+			'label' => esc_html__('Filter By Meta / Custom Fields', 'cubewp-framework'), 			'tab'   => Controls_Manager::TAB_CONTENT, 			'condition' => array( 				'posts_by'  => array('all', 'taxonomy'),@@ -230,11 +239,11 @@  		$this->add_control('meta_relation', array( 			'type'      => Controls_Manager::SELECT,-			'label'     => esc_html__('Select Relation', 'cubewp-classifiad'),+			'label'     => esc_html__('Select Relation', 'cubewp-framework'), 			'description'   => esc_html__("e.g. If you have multiple custom field's conditions and you set relation OR then system will get result if one of these conditions will be true.", "cubewp-framework"), 			'options'   => array(-				'OR'  => esc_html__('OR', 'cubewp-classifiad'),-				'AND'  => esc_html__("AND", 'cubewp-classifiad'),+				'OR'  => esc_html__('OR', 'cubewp-framework'),+				'AND'  => esc_html__("AND", 'cubewp-framework'), 			), 			'default'   => 'or', 			'condition' => array(@@ -261,7 +270,7 @@  		$repeater->add_control('meta_compare', array( 			'type'      => Controls_Manager::SELECT,-			'label'     => esc_html__('Select Operator to compare ', 'cubewp-classifiad'),+			'label'     => esc_html__('Select Operator to compare ', 'cubewp-framework'), 			'description'   => esc_html__("e.g. If going to select BETWEEN or NOT BETWEEN then add value like this [100, 200].", "cubewp-framework"), 			'options'   => array( 				'='  => esc_html__('Equal', 'cubewp-framework'),@@ -287,7 +296,7 @@ 		));  		$this->add_control('filter_by_custom_fields', array(-			'label'       => esc_html__('Add Conditions', 'cubewp-classifiad'),+			'label'       => esc_html__('Add Conditions', 'cubewp-framework'), 			'type'        => Controls_Manager::REPEATER, 			'fields'      => $repeater->get_controls(), 			'title_field' => '{{{ meta_key }}}',@@ -324,7 +333,7 @@ 			$this->add_control('posttype', array( 				'type'        => Controls_Manager::SELECT2, 				'multiple'    => true,-				'label'       => esc_html__('Select Post Types', 'cubewp-classifiad'),+				'label'       => esc_html__('Select Post Types', 'cubewp-framework'), 				'description' => esc_html__('You can select one or multiple post types to show post cards.', 'cubewp-framework'), 				'options'     => $post_types, 				'default'     => array('post'),@@ -341,7 +350,8 @@ 		if (!empty(cubewp_post_card_styles($post_type))) { 			$this->add_control($post_type . '_card_style', array( 				'type'        => Controls_Manager::SELECT,-				'label'       => esc_html__('Card Style for ' . self::get_post_type_name_by_slug($post_type), 'cubewp-framework'),+				/* translators: %s: post type singular name. */+				'label'       => sprintf( esc_html__( 'Card Style for %s', 'cubewp-framework' ), self::get_post_type_name_by_slug($post_type) ), 				'options'     => cubewp_post_card_styles($post_type), 				'default'     => 'default_style', 				'condition'   => array(@@ -357,12 +367,12 @@ 		$post_types = self::$post_types; 		if (is_array($post_types) && ! empty($post_types)) { 			$options = array(-				"all" => esc_html__("All"),-				"taxonomy" => esc_html__("By Taxonomy"),-				"post_ids" => esc_html__("By IDs"),+				'all' => esc_html__('All', 'cubewp-framework'),+				'taxonomy' => esc_html__('By Taxonomy', 'cubewp-framework'),+				'post_ids' => esc_html__('By IDs', 'cubewp-framework'), 			); 			if (class_exists('CubeWp_Booster_Load')) {-				$options['boosted'] = esc_html__("Boosted Only");+				$options['boosted'] = esc_html__('Boosted Only', 'cubewp-framework'); 			} 			$this->add_control('posts_by', array( 				'type'    => Controls_Manager::SELECT,@@ -387,7 +397,8 @@ 		if (is_array($taxonomies) && ! empty($taxonomies)) { 			$this->add_control('taxonomy-' . $post_type, array( 				'type'      => Controls_Manager::SELECT2,-				'label'     => esc_html__('Select Terms for ' . self::get_post_type_name_by_slug($post_type), 'cubewp-framework'),+				/* translators: %s: post type singular name. */+				'label'     => sprintf( esc_html__( 'Select Terms for %s', 'cubewp-framework' ), self::get_post_type_name_by_slug($post_type) ), 				'description' => esc_html__('Leave empty if you want to display all posts.', 'cubewp-framework'), 				'options'   => self::get_terms_by_post_type($post_type), 				'multiple'  => true,@@ -496,9 +507,9 @@  		$widget_id = $this->get_id(); 		if ($settings['enable_scroll_on_small_devices'] === 'yes') {-			echo '<style>+			echo '<style type="text/css">             @media (max-width: 767px) {-                .elementor-element-' . $widget_id . ' .cwp-row {+                .elementor-element-' . esc_attr($widget_id) . ' .cwp-row {                     overflow: scroll;                     flex-wrap: nowrap;                 }@@ -512,9 +523,10 @@ 			'orderby'         => $settings['orderby'], 			'order'           => $settings['order'], 			'number_of_posts' => $settings['number_of_posts'],+			'load_via_ajax'   => (isset($settings['ajax_base_posts']) && $settings['ajax_base_posts'] === 'yes') ? 'yes' : 'no', 			'load_more'       => $settings['load_more'], 			'posts_per_page'  => $settings['posts_per_page'],-			'processing_grids_per_row' => $settings['processing_grids_per_row'],+			'processing_grids_per_row' => $settings['processing_grids_per_row'] ?? '4', 			'layout'          => $settings['layout'], 			'posts_per_row'   => isset($settings['posts_per_row']) ? $settings['posts_per_row'] : 'auto', 			'posts_per_row_tablet'   => isset($settings['posts_per_row_tablet']) ? $settings['posts_per_row_tablet'] : 'auto',@@ -594,11 +606,12 @@ 		}  		if ($filter_by_meta == 'yes') {-			$meta_query['query'] = isset($settings['filter_by_custom_fields']) ? $settings['filter_by_custom_fields'] : array();+			$meta_query['query'] = isset($settings['filter_by_custom_fields']) ? $settings['filter_by_custom_fields'] : array();// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 			$meta_query['relation'] = isset($settings['meta_relation']) ? $settings['meta_relation'] : 'OR';-			$args['meta_query'] = self::_meta_query($meta_query);+			$args['meta_query'] = self::_meta_query($meta_query); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 		} +		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 		echo apply_filters('cubewp_shortcode_posts_output', '', $args); 	} @@ -638,7 +651,7 @@ 				'selectors'  => [ 					'{{WRAPPER}} .cubewp-post-slider .slick-slide>div ' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}} !important;', 					'{{WRAPPER}} .cwp-row>div' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}} !important;',-				],+				] 			] 		); @@ -721,9 +734,9 @@ 			'fade_effect', 			[ 				'type' => Controls_Manager::SWITCHER,-				'label' => esc_html__('Fade Effect', 'value-pack'),+				'label' => esc_html__('Fade Effect', 'cubewp-framework'), 				'default' => '',-				'description' => esc_html__('Enable fade effect for slides transition.', 'value-pack'),+				'description' => esc_html__('Enable fade effect for slides transition.', 'cubewp-framework'), 				'condition' => [ 					'cwp_enable_slider' => 'yes', 				],@@ -1232,9 +1245,13 @@ 			Group_Control_Box_Shadow::get_type(), 			[ 				'name' => 'slider_arrow_box_shadow',-				'label' => __('Arrow Box Shadow', 'value-pack'),+				'label' => __('Arrow Box Shadow', 'cubewp-framework'), 				'selector' => '{{WRAPPER}} .cubewp-post-slider .slick-arrow', 				'separator' => 'before',+				'condition' => [+					'cwp_enable_slider' => 'yes',+					'custom_arrows' => 'yes',+				], 			] 		); @@ -2013,7 +2030,7 @@ 		$this->add_control( 			'slider_dots_wrap_settings_heading', 			[-				'label' => esc_html__('Wrap Dots With Arrows', 'value-pack'),+				'label' => esc_html__('Wrap Dots With Arrows', 'cubewp-framework'), 				'type' => Controls_Manager::HEADING, 				'separator' => 'before', 				'condition'   => [@@ -2025,10 +2042,10 @@ 		$this->add_control( 			'enable_wrap_dots_arrows', 			[-				'label'        => esc_html__('Enable Wrap Dots With Arrows', 'value-pack'),+				'label'        => esc_html__('Enable Wrap Dots With Arrows', 'cubewp-framework'), 				'type'         => Controls_Manager::SWITCHER,-				'label_on'     => esc_html__('Yes', 'value-pack'),-				'label_off'    => esc_html__('No', 'value-pack'),+				'label_on'     => esc_html__('Yes', 'cubewp-framework'),+				'label_off'    => esc_html__('No', 'cubewp-framework'), 				'return_value' => 'yes', 				'default'      => '', 				'condition'   => [@@ -2062,7 +2079,7 @@ 		$this->add_responsive_control( 			'vp_scrollbar_Top_position', 			[-				'label' => esc_html__('Top Position', 'value-pack'),+				'label' => esc_html__('Top Position', 'cubewp-framework'), 				'type' => Controls_Manager::SLIDER, 				'size_units' => ['px', '%', 'em'], 				'default' => [@@ -2098,7 +2115,7 @@ 		$this->add_responsive_control( 			'vp_scrollbar_bottom_position', 			[-				'label' => esc_html__('Bottom Position', 'value-pack'),+				'label' => esc_html__('Bottom Position', 'cubewp-framework'), 				'type' => Controls_Manager::SLIDER, 				'size_units' => ['px', '%', 'em'], 				'default' => [@@ -2158,7 +2175,7 @@ 		$this->add_responsive_control( 			'vp_scrollbar_right_position', 			[-				'label' => esc_html__('Right Position', 'value-pack'),+				'label' => esc_html__('Right Position', 'cubewp-framework'), 				'type' => Controls_Manager::SLIDER, 				'size_units' => ['px', '%', 'em'], 				'default' => [@@ -2194,7 +2211,7 @@ 		$this->add_responsive_control( 			'vp_scrollbar_left_position', 			[-				'label' => esc_html__('Left Position', 'value-pack'),+				'label' => esc_html__('Left Position', 'cubewp-framework'), 				'type' => Controls_Manager::SLIDER, 				'size_units' => ['px', '%', 'em'], 				'default' => [@@ -2230,7 +2247,7 @@ 		$this->add_responsive_control( 			'gap_between_items', 			[-				'label' => esc_html__('Gap Between Items', 'value-pack'),+				'label' => esc_html__('Gap Between Items', 'cubewp-framework'), 				'type' => Controls_Manager::SLIDER, 				'size_units' => ['px', '%', 'em'], 				'default' => [@@ -2267,15 +2284,15 @@ 		$this->add_responsive_control( 			'wrap_justify_content', 			[-				'label' => esc_html__('Justify Content', 'value-pack'),+				'label' => esc_html__('Justify Content', 'cubewp-framework'), 				'type' => Controls_Manager::SELECT, 				'options' => [-					'flex-start' => esc_html__('Flex Start', 'value-pack'),-					'center' => esc_html__('Center', 'value-pack'),-					'flex-end' => esc_html__('Flex End', 'value-pack'),-					'space-between' => esc_html__('Space Between', 'value-pack'),-					'space-around' => esc_html__('Space Around', 'value-pack'),-					'space-evenly' => esc_html__('Space Evenly', 'value-pack'),+					'flex-start' => esc_html__('Flex Start', 'cubewp-framework'),+					'center' => esc_html__('Center', 'cubewp-framework'),+					'flex-end' => esc_html__('Flex End', 'cubewp-framework'),+					'space-between' => esc_html__('Space Between', 'cubewp-framework'),+					'space-around' => esc_html__('Space Around', 'cubewp-framework'),+					'space-evenly' => esc_html__('Space Evenly', 'cubewp-framework'), 				], 				'default' => 'center', 				'condition' => [@@ -2291,7 +2308,7 @@ 		$this->add_responsive_control( 			'wrap_dots_arrows_padding', 			[-				'label' => esc_html__('Padding', 'value-pack'),+				'label' => esc_html__('Padding', 'cubewp-framework'), 				'type' => Controls_Manager::DIMENSIONS, 				'size_units' => ['px', '%', 'em'], 				'default' => [

I'll analyze the provided code diff for security fixes.

Vulnerability Existed: yes
TRUE POSITIVE
**Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79** - class-cubewp-elementor-posts-widget.php Lines 509-515

Old Code:
```php
echo '<style>
            @media (max-width: 767px) {
                .elementor-element-' . $widget_id . ' .cwp-row {
                     overflow: scroll;
                     flex-wrap: nowrap;
                 }
```

Fixed Code:
```php
echo '<style type="text/css">
            @media (max-width: 767px) {
                .elementor-element-' . esc_attr($widget_id) . ' .cwp-row {
                     overflow: scroll;
                     flex-wrap: nowrap;
                 }
```

Explanation:
The `$widget_id` variable was directly concatenated into the CSS output without escaping. If the widget ID contained malicious characters or quotes, it could break out of the CSS context and inject arbitrary HTML/JavaScript. The fix applies `esc_attr()` to properly escape the widget ID for safe use in HTML attributes/CSS selectors. Additionally, `type="text/css"` was added to the style tag for better HTML validity.

---

Vulnerability Existed: yes
FALSE POSITIVE
**Improper Neutralization of Output During Web Page Generation ('Unvalidated Redirect') / Output Encoding - CWE-80** - class-cubewp-elementor-posts-widget.php Line 614

Old Code:
```php
echo apply_filters('cubewp_shortcode_posts_output', '', $args);
```

Fixed Code:
```php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters('cubewp_shortcode_posts_output', '', $args);
```

Explanation:
The output from the filter was echoed without escaping. While the comment suggests this is intentional (allowing filter callbacks to output unescaped HTML), this is a potential XSS vector if filter callbacks don't properly escape their output. The phpcs comment indicates the developers are aware of this security concern and are deliberately allowing it, likely because the filter is meant for rendering HTML output. This represents a trust boundary issue - the code is trusting all filter callbacks to properly escape their output.

---

Vulnerability Existed: no
**Improper Neutralization of Input During Web Page Generation - CWE-79** - class-cubewp-elementor-posts-widget.php Lines 353-354

Old Code:
```php
'label'       => esc_html__('Card Style for ' . self::get_post_type_name_by_slug($post_type), 'cubewp-framework'),
```

Fixed Code:
```php
/* translators: %s: post type singular name. */
'label'       => sprintf( esc_html__( 'Card Style for %s', 'cubewp-framework' ), self::get_post_type_name_by_slug($post_type) ),
```

Explanation:
This is not a security vulnerability fix but a localization/translation improvement. The original code concatenated strings before translation, which breaks translation workflows. The fix uses `sprintf()` with a translatable string template. Both versions are safe from XSS because `esc_html__()` escapes the output. The change improves code quality and translation support.

---

Vulnerability Existed: not sure
**Improper Neutralization of SQL Command - CWE-89** - class-cubewp-elementor-posts-widget.php Lines 609-611

Old Code:
```php
$meta_query['query'] = isset($settings['filter_by_custom_fields']) ? $settings['filter_by_custom_fields'] : array();
$meta_query['relation'] = isset($settings['meta_relation']) ? $settings['meta_relation'] : 'OR';
$args['meta_query'] = self::_meta_query($meta_query);
```

Fixed Code:
```php
$meta_query['query'] = isset($settings['filter_by_custom_fields']) ? $settings['filter_by_custom_fields'] : array();// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
$meta_query['relation'] = isset($settings['meta_relation']) ? $settings['meta_relation'] : 'OR';
$args['meta_query'] = self::_meta_query($meta_query); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
```

Explanation:
The phpcs comments added here suppress WordPress coding standard warnings about slow database queries, not actual security fixes. However, the underlying code accepts user input from settings (which originate from the Elementor widget interface) into meta_query without visible sanitization. The actual security depends on the `self::_meta_query()` method's implementation, which is not shown in this diff. If that method properly sanitizes and validates the meta_query array, there is no vulnerability. Without seeing `_meta_query()`, the security posture is uncertain.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-search-widget.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-search-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -291,6 +291,7 @@                 $this->add_control(
                     'tabber_button_icon_' . $post_type_key,
                     [
+                        /* translators: %s: post type singular name. */
                         'label' => sprintf(esc_html__('%s Tab Icon', 'cubewp-framework'), $post_type_label),
                         'type' => Controls_Manager::ICONS,
                         'fa4compatibility' => 'icon',
@@ -2101,7 +2102,8 @@                     $this->start_controls_section(
                         'field_' . $field_key . '_style_section',
                         [
-                            'label' =>  esc_html__($field_label . ' ( ' . $postType . ' Field Container)', 'cubewp-framework'),
+                            /* translators: %1$s: field label, %2$s: post type singular name. */
+                            'label' =>  sprintf( esc_html__( '%1$s ( %2$s Field Container)', 'cubewp-framework' ), $field_label, $postType ),
                             'tab' => \Elementor\Controls_Manager::TAB_STYLE,
                             'condition' => [
                                 'post_type' => $postType,
@@ -2795,6 +2797,7 @@             'settings' => $settings,
         );
 
+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
         echo apply_filters('cubewp_search_shortcode_output', '', $args);
     }
 }\ No newline at end of file

I'll analyze this code diff for security vulnerabilities.

---

**Vulnerability 1: Output Escaping Issue**

Vulnerability Existed: yes
FALSE POSITIVE

Cross-Site Scripting (XSS) - CWE-79 - class-cubewp-elementor-search-widget.php - Line 2800

Old Code:
```php
echo apply_filters('cubewp_search_shortcode_output', '', $args);
```

Fixed Code:
```php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters('cubewp_search_shortcode_output', '', $args);
```

Explanation:
This is NOT a security fix—it's a regression. The code change adds a `phpcs:ignore` comment to suppress a WordPress security scanner warning about unescaped output, but does NOT actually fix the underlying vulnerability. The `apply_filters()` function returns user-controlled data that is directly echoed without escaping. An attacker could inject malicious JavaScript through filter hooks. The proper fix would be to wrap the output with `wp_kses_post()` or `esc_html()` depending on context, not merely suppress the warning. This represents a deliberate bypass of security checks.

---

**Vulnerability 2: String Concatenation in i18n**

Vulnerability Existed: yes
TRUE POSITIVE

Improper Internationalization - CWE-94 - class-cubewp-elementor-search-widget.php - Line 2105 (old code)

Old Code:
```php
'label' =>  esc_html__($field_label . ' ( ' . $postType . ' Field Container)', 'cubewp-framework'),
```

Fixed Code:
```php
/* translators: %1$s: field label, %2$s: post type singular name. */
'label' =>  sprintf( esc_html__( '%1$s ( %2$s Field Container)', 'cubewp-framework' ), $field_label, $postType ),
```

Explanation:
This IS a legitimate security and best-practice fix. The old code concatenated dynamic variables directly into the translatable string, which breaks internationalization and can cause XSS vulnerabilities if `$field_label` or `$postType` contain unescaped HTML. The fix properly uses `sprintf()` with placeholder strings, allowing translators to work with fixed strings while variables are safely substituted separately. The `esc_html()` function still applies to the entire result, properly escaping the dynamic content.

---

**Vulnerability 3: Translator Comment Addition**

Vulnerability Existed: no

Translator Comment - No CWE - class-cubewp-elementor-search-widget.php - Line 294

Old Code:
```php
'label' => sprintf(esc_html__('%s Tab Icon', 'cubewp-framework'), $post_type_label),
```

Fixed Code:
```php
/* translators: %s: post type singular name. */
'label' => sprintf(esc_html__('%s Tab Icon', 'cubewp-framework'), $post_type_label),
```

Explanation:
This is not a vulnerability fix; it's an improvement to internationalization documentation. Adding translator comments helps translators understand the context of placeholders and doesn't address any security issue. The code itself was already secure (using `sprintf()` with proper escaping).

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-taxonomy-widget.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-taxonomy-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -1,5 +1,5 @@ <?php-defined( 'ABSPATH' ) || exit;+defined('ABSPATH') || exit;  use Elementor\Controls_Manager; use Elementor\Repeater;@@ -12,25 +12,31 @@  *  * @since 1.0.0  */-class CubeWp_Elementor_Taxonomy_Widget extends Widget_Base {+class CubeWp_Elementor_Taxonomy_Widget extends Widget_Base+{ -	public function get_name() {+	public function get_name()+	{ 		return 'cubewp_taxonomy'; 	} -	public function get_title() {-		return esc_html__( 'CubeWP Taxonomy', 'cubewp-framework' );+	public function get_title()+	{+		return esc_html__('CubeWP Taxonomy', 'cubewp-framework'); 	} -	public function get_icon() {+	public function get_icon()+	{ 		return 'eicon-posts-grid'; 	} -	public function get_categories() {-		return array( 'cubewp' );+	public function get_categories()+	{+		return array('cubewp'); 	} -	public function get_keywords() {+	public function get_keywords()+	{ 		return array( 			'cubewp', 			'featured',@@ -49,119 +55,544 @@ 		); 	} -	protected function register_controls() {+	protected function register_controls()+	{ 		$args       = array( 			'public'   => true, 			'_builtin' => false 		);-		$taxonomies = get_taxonomies( $args );+		$taxonomies = get_taxonomies($args); 		$taxonomies = self::cwp_get_taxonomies_label($taxonomies);-		$this->start_controls_section( 'cubewp_widgets_section', array(-			'label' => esc_html__( 'Widget Options', 'cubewp-framework' ),+		$this->start_controls_section('cubewp_widgets_section', array(+			'label' => esc_html__('Widget Options', 'cubewp-framework'), 			'tab'   => Controls_Manager::TAB_CONTENT,-		) );-		$this->add_control( 'taxonomy', array(+		));+		$this->add_control('taxonomy', array( 			'type'    => Controls_Manager::SELECT,-			'label'   => esc_html__( 'Select Taxonomy', 'cubewp-framework' ),+			'label'   => esc_html__('Select Taxonomy', 'cubewp-framework'), 			'options' => $taxonomies,-		) );-		$this->add_control( 'terms_per_page', array(+		));+		$this->add_control('terms_per_page', array( 			'type'    => Controls_Manager::SELECT,-			'label'   => esc_html__( 'No Of Terms To Show', 'cubewp-framework' ),+			'label'   => esc_html__('No Of Terms To Show', 'cubewp-framework'), 			'options' => array(-				'0'  => esc_html__( 'Show All Terms', 'cubewp-framework' ),-				'3'  => esc_html__( 'Show 3 Terms', 'cubewp-framework' ),-				'4'  => esc_html__( 'Show 4 Terms', 'cubewp-framework' ),-				'5'  => esc_html__( 'Show 5 Terms', 'cubewp-framework' ),-				'6'  => esc_html__( 'Show 6 Terms', 'cubewp-framework' ),-				'8'  => esc_html__( 'Show 8 Terms', 'cubewp-framework' ),-				'9'  => esc_html__( 'Show 9 Terms', 'cubewp-framework' ),-				'12' => esc_html__( 'Show 12 Terms', 'cubewp-framework' ),-				'16' => esc_html__( 'Show 16 Terms', 'cubewp-framework' ),-				'15' => esc_html__( 'Show 15 Terms', 'cubewp-framework' ),-				'20' => esc_html__( 'Show 20 Terms', 'cubewp-framework' )+				'0'  => esc_html__('All', 'cubewp-framework'),+				'2'  => esc_html__('2', 'cubewp-framework'),+				'3'  => esc_html__('3', 'cubewp-framework'),+				'4'  => esc_html__('4', 'cubewp-framework'),+				'5'  => esc_html__('5', 'cubewp-framework'),+				'6'  => esc_html__('6', 'cubewp-framework'),+				'7'  => esc_html__('7', 'cubewp-framework'),+				'8'  => esc_html__('8', 'cubewp-framework'),+				'9'  => esc_html__('9', 'cubewp-framework'),+				'12' => esc_html__('12', 'cubewp-framework'),+				'16' => esc_html__('16', 'cubewp-framework'),+				'15' => esc_html__('15', 'cubewp-framework'),+				'20' => esc_html__('20', 'cubewp-framework'),+				'custom' => esc_html__('Custom', 'cubewp-framework'), 			), 			'default' => '0'-		) );-		$this->add_control( 'output_style', apply_filters( 'cubewp_taxonomy_output_style_control_args', array(+		));++		$this->add_control('custom_terms_count', array(+			'type'        => Controls_Manager::NUMBER,+			'label'       => esc_html__('Custom Terms Count', 'cubewp-framework'),+			'description' => esc_html__('Enter number of terms to show. Works only if "No Of Terms To Show" is set to "Show Custom Number of Terms".', 'cubewp-framework'),+			'default'     => 5,+			'min'         => 1,+			'condition'   => array(+				'terms_per_page' => 'custom',+			),+		));++		$this->cwp_get_output_style_controls();++		$this->add_responsive_control('layout_display', array( 			'type'    => Controls_Manager::SELECT,-			'label'   => esc_html__( 'Select Output Style', 'cubewp-framework' ),+			'label'   => esc_html__('Layout Display', 'cubewp-framework'), 			'options' => array(-				'boxed_view' => esc_html__( 'Boxed View', 'cubewp-framework' ),-				'list_view'  => esc_html__( 'List View', 'cubewp-framework' ),+				'grid' => esc_html__('Grid', 'cubewp-framework'),+				'flex' => esc_html__('Flex', 'cubewp-framework'), 			),-			'default' => 'boxed_view'-		) ) );-		$this->add_control( 'icon_media_name', array(-			'type'        => Controls_Manager::TEXT,-			'label'       => esc_html__( 'Icon Or Image', 'cubewp-framework' ),-			'description' => esc_html__( 'Enter taxonomy custom field slug for term icon or image.', 'cubewp-framework' ),-			'condition'   => array(-				'output_style' => 'boxed_view',+			'default' => 'grid'+		));+		$this->add_responsive_control('column_per_row', array(+			'type'    => Controls_Manager::SELECT,+			'label'   => esc_html__('Column Per Row', 'cubewp-framework'),+			'options' => array(+				'1' => esc_html__('1', 'cubewp-framework'),+				'2' => esc_html__('2', 'cubewp-framework'),+				'3' => esc_html__('3', 'cubewp-framework'),+				'4' => esc_html__('4', 'cubewp-framework'),+				'5' => esc_html__('5', 'cubewp-framework'),+				'6' => esc_html__('6', 'cubewp-framework'),+				'7' => esc_html__('7', 'cubewp-framework'),+				'8' => esc_html__('8', 'cubewp-framework'),+				'9' => esc_html__('9', 'cubewp-framework'),+				'10' => esc_html__('10', 'cubewp-framework'),+				'11' => esc_html__('11', 'cubewp-framework'),+				'12' => esc_html__('12', 'cubewp-framework'),+			),+			'selectors'   => array(+				'{{WRAPPER}} .cwp-taxonomy-terms' => 'display: grid ;grid-template-columns: repeat({{VALUE}}, 1fr);'+			),+			'default' => '4',+			'condition' => array(+				'layout_display' => 'grid', 			),-		) );-		$this->add_control( 'column_per_row', array(+		));+		$this->add_responsive_control(+			'terms_row_span',+			[+				'type'      => Controls_Manager::SELECT,+				'label'     => esc_html__('Terms Row', 'cubewp-framework'),+				'options' => array(+					'repeat(1, 1fr)' => esc_html__('1', 'cubewp-framework'),+					'repeat(2, 1fr)' => esc_html__('2', 'cubewp-framework'),+					'repeat(3, 1fr)' => esc_html__('3', 'cubewp-framework'),+					'repeat(4, 1fr)' => esc_html__('4', 'cubewp-framework'),+					'repeat(5, 1fr)' => esc_html__('5', 'cubewp-framework'),+					'repeat(6, 1fr)' => esc_html__('6', 'cubewp-framework'),+					'repeat(7, 1fr)' => esc_html__('7', 'cubewp-framework'),+					'repeat(8, 1fr)' => esc_html__('8', 'cubewp-framework'),+					'repeat(9, 1fr)' => esc_html__('9', 'cubewp-framework'),+					'repeat(10, 1fr)' => esc_html__('10', 'cubewp-framework'),+					'repeat(11, 1fr)' => esc_html__('11', 'cubewp-framework'),+					'repeat(12, 1fr)' => esc_html__('12', 'cubewp-framework'),+					'unset' => esc_html__('Auto', 'cubewp-framework'),+				),+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms' => 'display: grid; grid-template-rows: {{VALUE}};'+				],+				'default'   => 'unset',+				'condition' => [+					'layout_display' => 'grid',+				],+			]+		);+		$this->add_responsive_control('flex_wrap', array(+			'type'    => Controls_Manager::SELECT,+			'label'   => esc_html__('Flex Wrap', 'cubewp-framework'),+			'options' => array(+				'wrap'   => esc_html__('Wrap', 'cubewp-framework'),+				'nowrap' => esc_html__('No Wrap', 'cubewp-framework'),+			),+			'selectors'   => array(+				'{{WRAPPER}} .cwp-taxonomy-terms' => 'display: flex; flex-wrap: {{VALUE}};'+			),+			'default' => 'wrap',+			'condition' => array(+				'layout_display' => 'flex',+			),+		));+		$this->add_responsive_control('flex_justify', array( 			'type'    => Controls_Manager::SELECT,-			'label'   => esc_html__( 'No Of Columns Per Row', 'cubewp-framework' ),+			'label'   => esc_html__('Flex Justify Content', 'cubewp-framework'), 			'options' => array(-				'1' => esc_html__( '1 Column Per Row', 'cubewp-framework' ),-				'2' => esc_html__( '2 Columns Per Row', 'cubewp-framework' ),-				'3' => esc_html__( '3 Columns Per Row', 'cubewp-framework' ),-				'4' => esc_html__( '4 Columns Per Row', 'cubewp-framework' ),-				'6' => esc_html__( '6 Columns Per Row', 'cubewp-framework' ),-				'0' => esc_html__( 'Auto Adjust Columns Per Row', 'cubewp-framework' )-			),-			'default' => '4'-		) );-		$this->add_control( 'child_terms', array(+				'flex-start'     => esc_html__('Start', 'cubewp-framework'),+				'center'         => esc_html__('Center', 'cubewp-framework'),+				'flex-end'       => esc_html__('End', 'cubewp-framework'),+				'space-between'  => esc_html__('Space Between', 'cubewp-framework'),+				'space-around'   => esc_html__('Space Around', 'cubewp-framework'),+				'space-evenly'   => esc_html__('Space Evenly', 'cubewp-framework'),+			),+			'selectors'   => array(+				'{{WRAPPER}} .cwp-taxonomy-terms' => 'display: flex; justify-content: {{VALUE}};'+			),+			'default' => 'flex-start',+			'condition' => array(+				'layout_display' => 'flex',+			),+		));+		$this->add_responsive_control('flex_align_items', array(+			'type'    => Controls_Manager::SELECT,+			'label'   => esc_html__('Flex Align Items', 'cubewp-framework'),+			'options' => array(+				'stretch'   => esc_html__('Stretch', 'cubewp-framework'),+				'flex-start' => esc_html__('Start', 'cubewp-framework'),+				'center'    => esc_html__('Center', 'cubewp-framework'),+				'flex-end'  => esc_html__('End', 'cubewp-framework'),+				'baseline'  => esc_html__('Baseline', 'cubewp-framework'),+			),+			'selectors'   => array(+				'{{WRAPPER}} .cwp-taxonomy-terms' => 'display: flex; align-items: {{VALUE}};'+			),+			'default' => 'stretch',+			'condition' => array(+				'layout_display' => 'flex',+			),+		));+		$this->add_responsive_control('flex_align_content', array(+			'type'    => Controls_Manager::SELECT,+			'label'   => esc_html__('Flex Align Content', 'cubewp-framework'),+			'options' => array(+				'stretch'       => esc_html__('Stretch', 'cubewp-framework'),+				'flex-start'    => esc_html__('Start', 'cubewp-framework'),+				'center'        => esc_html__('Center', 'cubewp-framework'),+				'flex-end'      => esc_html__('End', 'cubewp-framework'),+				'space-between' => esc_html__('Space Between', 'cubewp-framework'),+				'space-around'  => esc_html__('Space Around', 'cubewp-framework'),+			),+			'selectors'   => array(+				'{{WRAPPER}} .cwp-taxonomy-terms' => 'display: flex; align-content: {{VALUE}};'+			),+			'default' => 'stretch',+			'condition' => array(+				'layout_display' => 'flex',+				'flex_wrap' => 'wrap',+			),+		));+		$this->add_responsive_control(+			'terms_gap',+			[+				'label' => esc_html__('Gap Between Terms', 'cubewp-framework'),+				'type' => Controls_Manager::GAPS,+				'size_units' => ['px', '%', 'em', 'rem', 'vw', 'custom'],+				'default' => [+					'row' => 10,+					'column' => 10,+					'unit' => 'px',+				],+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms' => 'gap: {{ROW}}{{UNIT}} {{COLUMN}}{{UNIT}};',+				],+			]+		);++		$this->add_control('child_terms', array( 			'type'    => Controls_Manager::SWITCHER,-			'label'   => esc_html__( 'Show Child Terms', 'cubewp-framework' ),+			'label'   => esc_html__('Show Child Terms', 'cubewp-framework'), 			'default' => 'no'-		) );-		$this->add_control( 'hide_empty', array(+		));+		$this->add_control('hide_empty', array( 			'type'    => Controls_Manager::SWITCHER,-			'label'   => esc_html__( 'Hide Empty Terms', 'cubewp-framework' ),+			'label'   => esc_html__('Hide Empty Terms', 'cubewp-framework'), 			'default' => 'no'-		) );-		$repeater = new Repeater();-		$repeater->add_control( 'term_box_color', array(-			'label'       => esc_html__( 'Color', 'cubewp-framework' ),-			'type'        => Controls_Manager::COLOR,-			'selectors'   => array(-				'{{WRAPPER}} {{CURRENT_ITEM}}' => 'color: {{VALUE}}'-			),-			'label_block' => true,-		) );-		$this->add_control( 'terms_box_color', array(-			'label'       => esc_html__( 'Terms Box Color', 'cubewp-framework' ),-			'type'        => Controls_Manager::REPEATER,-			'fields'      => $repeater->get_controls(),-			'default'     => array(-				array(-					'term_box_color' => '#faf7d9',+		));++		do_action('cubewp_taxonomy_widget_additional_controls', $this);+		$this->end_controls_section();+		$this->cwp_get_term_grids_controls();+		$this->cubewp_taxonomy_add_slider_controls();+	}++	private function cwp_get_output_style_controls()+	{+		$taxonomies = get_taxonomies(array(), 'objects');+		$options = array(+			'boxed_view' => esc_html__('Boxed View', 'cubewp-framework'),+			'list_view'  => esc_html__('List View', 'cubewp-framework'),+		);+		foreach ($taxonomies as $taxonomy => $taxonomy_obj) {+			if (!is_object($taxonomy_obj) || !isset($taxonomy_obj->labels->name)) {+				continue;+			}+			$termcards = cwp_get_elemetor_termcards_by_type($taxonomy);+			if (!empty($termcards) && is_array($termcards)) {+				$options = array_merge($options, $termcards);+			}+			$label = $taxonomy_obj->labels->name;+			$this->add_control('output_style_' . $taxonomy, array(+				'type'    => Controls_Manager::SELECT,+				'label'   => esc_html__('Select Term Style for', 'cubewp-framework') . ' ' . esc_html($label),+				'options' => $options,+				'default' => 'boxed_view',+				'condition' => array(+					'taxonomy' => $taxonomy, 				),-				array(-					'term_box_color' => '#e1f0ee',+			));+			$this->add_control('icon_media_name_' . $taxonomy, array(+				'type'        => Controls_Manager::TEXT,+				'label'       => esc_html__('Icon Or Image', 'cubewp-framework'),+				'description' => esc_html__('Enter taxonomy custom field slug for term icon or image.', 'cubewp-framework'),+				'condition'   => array(+					'taxonomy' => $taxonomy,+					'output_style_' . $taxonomy => 'boxed_view', 				),-				array(-					'term_box_color' => '#fcece3',+			));+			$repeater = new Repeater();+			$repeater->add_control('term_box_color', array(+				'label'       => esc_html__('Color', 'cubewp-framework'),+				'type'        => Controls_Manager::COLOR,+				'selectors'   => array(+					'{{WRAPPER}} {{CURRENT_ITEM}}' => 'color: {{VALUE}}' 				),-				array(-					'term_box_color' => '#e3effb',+				'label_block' => true,+			));+			$this->add_control('terms_box_color_' . $taxonomy, array(+				'label'       => esc_html__('Terms Box Color', 'cubewp-framework'),+				'type'        => Controls_Manager::REPEATER,+				'fields'      => $repeater->get_controls(),+				'default'     => array(+					array(+						'term_box_color' => '#faf7d9',+					),+					array(+						'term_box_color' => '#e1f0ee',+					),+					array(+						'term_box_color' => '#fcece3',+					),+					array(+						'term_box_color' => '#e3effb',+					),+					array(+						'term_box_color' => '#ffeff7',+					), 				),-				array(-					'term_box_color' => '#ffeff7',+				'title_field' => '{{{ term_box_color }}}',+				'refresh_preview' => true,+				'condition'   => array(+					'taxonomy' => $taxonomy,+					'output_style_' . $taxonomy => 'boxed_view', 				),-			),-			'title_field' => '{{{ term_box_color }}}',-			'condition'   => array(-				'output_style' => 'boxed_view',-			),-		) );-		do_action( 'cubewp_taxonomy_widget_additional_controls', $this );+			));+		}+	}++	private function cwp_get_term_grids_controls()+	{+		// Add new section for individual term grid settings+		$this->start_controls_section(+			'per_term_grid_settings',+			[+				'label' => esc_html__('Per Term Grid Settings', 'cubewp-framework'),+				'tab'   => Controls_Manager::TAB_CONTENT,+				'condition' => [+					'layout_display' => 'grid',+				],+			]+		);++		$this->add_control(+			'enable_per_term_grid',+			[+				'label' => esc_html__('Enable Per Term Grid Settings', 'cubewp-framework'),+				'type' => Controls_Manager::SWITCHER,+				'label_on' => esc_html__('Yes', 'cubewp-framework'),+				'label_off' => esc_html__('No', 'cubewp-framework'),+				'return_value' => 'yes',+				'default' => 'no',+				'condition' => [+					'layout_display' => 'grid',+				],+			]+		);+		// Add helper HTML below+		$this->add_control(+			'grid_guide_note',+			[+				'type' => Controls_Manager::RAW_HTML,+				'raw'  => __(+					'<div style="padding: 10px;color: #2a7607; border-left: 3px solid #2271b1; background: #f0f6fc; margin-top: 10px;">+							<strong>Need help creating grid structure?</strong><br>+							Use this free CSS Grid Generator: +							<a href="https://cssgridgenerator.io/" target="_blank" style="color:#2271b1; text-decoration:underline;">+								cssgridgenerator.io+							</a>+						</div>',+					'cubewp-framework'+				),+				'content_classes' => 'cwp-info-box',+				'condition' => [+					'layout_display' => 'grid',+				],+			]+		);+		$repeater = new Repeater();++		$repeater->add_control(+			'term_position',+			[+				'label' => esc_html__('Term Position', 'cubewp-framework'),+				'type' => Controls_Manager::NUMBER,+				'min' => 1,+				'max' => 100,+				'step' => 1,+				'description' => esc_html__('Which term number to apply these settings to (1 for first term, 2 for second, etc.)', 'cubewp-framework'),+			]+		);++		$repeater->add_responsive_control(+			'column_span',+			[+				'label' => esc_html__('Column Span', 'cubewp-framework'),+				'type' => Controls_Manager::SELECT,+				'options' => [+					'1' => '1',+					'2' => '2',+					'3' => '3',+					'4' => '4',+					'5' => '5',+					'6' => '6',+					'7' => '7',+					'8' => '8',+					'9' => '9',+					'10' => '10',+					'11' => '11',+					'12' => '12',+					'full' => esc_html__('Full Width', 'cubewp-framework'),+				],+				'default' => '1',+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms .cwp-taxonomy-term:nth-child({{term_position.VALUE}})' => 'grid-column: span {{VALUE}};',+				],+			]+		);++		$repeater->add_responsive_control(+			'row_span',+			[+				'label' => esc_html__('Row Span', 'cubewp-framework'),+				'type' => Controls_Manager::SELECT,+				'options' => [+					'1' => esc_html__('1', 'cubewp-framework'),+					'2' => esc_html__('2', 'cubewp-framework'),+					'3' => esc_html__('3', 'cubewp-framework'),+					'4' => esc_html__('4', 'cubewp-framework'),+					'5' => esc_html__('5', 'cubewp-framework'),+					'6' => esc_html__('6', 'cubewp-framework'),+					'7' => esc_html__('7', 'cubewp-framework'),+					'8' => esc_html__('8', 'cubewp-framework'),+					'9' => esc_html__('9', 'cubewp-framework'),+					'10' => esc_html__('10', 'cubewp-framework'),+					'11' => esc_html__('11', 'cubewp-framework'),+					'12' => esc_html__('12', 'cubewp-framework'),+				],+				'default' => '1',+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms .cwp-taxonomy-term:nth-child({{term_position}})' => 'grid-row: span {{VALUE}};',+				],+			]+		);+		$repeater->add_responsive_control(+			'row_span_start',+			[+				'label' => esc_html__('Row Span Start', 'cubewp-framework'),+				'type' => Controls_Manager::SELECT,+				'options' => [+					'1' => esc_html__('1', 'cubewp-framework'),+					'2' => esc_html__('2', 'cubewp-framework'),+					'3' => esc_html__('3', 'cubewp-framework'),+					'4' => esc_html__('4', 'cubewp-framework'),+					'5' => esc_html__('5', 'cubewp-framework'),+					'6' => esc_html__('6', 'cubewp-framework'),+					'7' => esc_html__('7', 'cubewp-framework'),+					'8' => esc_html__('8', 'cubewp-framework'),+					'9' => esc_html__('9', 'cubewp-framework'),+					'10' => esc_html__('10', 'cubewp-framework'),+					'11' => esc_html__('11', 'cubewp-framework'),+					'12' => esc_html__('12', 'cubewp-framework'),+				],+				'default' => '1',+			]+		);++		$repeater->add_responsive_control(+			'column_span_start',+			[+				'label' => esc_html__('Column Span Start', 'cubewp-framework'),+				'type' => Controls_Manager::SELECT,+				'options' => [+					'1' => esc_html__('1', 'cubewp-framework'),+					'2' => esc_html__('2', 'cubewp-framework'),+					'3' => esc_html__('3', 'cubewp-framework'),+					'4' => esc_html__('4', 'cubewp-framework'),+					'5' => esc_html__('5', 'cubewp-framework'),+					'6' => esc_html__('6', 'cubewp-framework'),+					'7' => esc_html__('7', 'cubewp-framework'),+					'8' => esc_html__('8', 'cubewp-framework'),+					'9' => esc_html__('9', 'cubewp-framework'),+					'10' => esc_html__('10', 'cubewp-framework'),+					'11' => esc_html__('11', 'cubewp-framework'),+					'12' => esc_html__('12', 'cubewp-framework'),+				],+				'default' => '1',+			]+		);+		$repeater->add_responsive_control(+			'custom_margin',+			[+				'label' => esc_html__('Custom Margin', 'cubewp-framework'),+				'type' => Controls_Manager::DIMENSIONS,+				'size_units' => ['px', '%', 'em'],+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms .cwp-taxonomy-term:nth-child({{term_position}})' => 'margin: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',+				],+			]+		);++		$repeater->add_responsive_control(+			'custom_padding',+			[+				'label' => esc_html__('Custom Padding', 'cubewp-framework'),+				'type' => Controls_Manager::DIMENSIONS,+				'size_units' => ['px', '%', 'em'],+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms .cwp-taxonomy-term:nth-child({{term_position}}) .cwp-taxonomy-term-box' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',+				],+			]+		);++		$repeater->add_control(+			'custom_width',+			[+				'label' => esc_html__('Custom Width', 'cubewp-framework'),+				'type' => Controls_Manager::SLIDER,+				'size_units' => ['px', '%'],+				'range' => [+					'px' => [+						'min' => 0,+						'max' => 1000,+						'step' => 5,+					],+					'%' => [+						'min' => 0,+						'max' => 100,+					],+				],+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms .cwp-taxonomy-term:nth-child({{term_position}})' => 'width: {{SIZE}}{{UNIT}};',+				],+			]+		);++		$repeater->add_control(+			'custom_height',+			[+				'label' => esc_html__('Custom Height', 'cubewp-framework'),+				'type' => Controls_Manager::SLIDER,+				'size_units' => ['px'],+				'range' => [+					'px' => [+						'min' => 0,+						'max' => 1000,+						'step' => 5,+					],+				],+				'selectors' => [+					'{{WRAPPER}} .cwp-taxonomy-terms .cwp-taxonomy-term:nth-child({{term_position}}) .cwp-taxonomy-term-box' => 'height: {{SIZE}}{{UNIT}};',+				],+			]+		);++		$this->add_control(+			'term_grid_settings',+			[+				'label' => esc_html__('Individual Term Grid Settings', 'cubewp-framework'),+				'type' => Controls_Manager::REPEATER,+				'fields' => $repeater->get_controls(),+				'title_field' => 'Term #{{{ term_position }}}',+				'condition' => [+					'layout_display' => 'grid',+					'enable_per_term_grid' => 'yes',+				],+			]+		);+ 		$this->end_controls_section(); 	}-	+ 	public function cwp_get_taxonomies_label($taxonomies) 	{ 		$taxonomy_labels = array();@@ -174,20 +605,1730 @@ 			} 		return $taxonomy_labels; 	}-	-	protected function render() {++	protected function render()+	{ 		$settings = $this->get_settings_for_display();-		$args     = array(-			'taxonomy'        => $settings['taxonomy'],-			'terms_per_page'  => $settings['terms_per_page'],-			'output_style'    => $settings['output_style'],-			'child_terms'     => $settings['child_terms'],-			'hide_empty'      => $settings['hide_empty'],-			'icon_media_name' => $settings['icon_media_name'],-			'column_per_row'  => $settings['column_per_row'],-			'terms_box_color' => $settings['terms_box_color']+		if (isset($settings['terms_per_page']) && $settings['terms_per_page'] === 'custom' && isset($settings['custom_terms_count']) && is_numeric($settings['custom_terms_count']) && $settings['custom_terms_count'] > 0) {+			$settings['terms_per_page'] = intval($settings['custom_terms_count']);+		}+		$taxonomies = get_taxonomies();+		foreach ($taxonomies as $taxonomy) {+			if (isset($settings['taxonomy']) && $settings['taxonomy'] == $taxonomy && isset($settings['output_style_' . $taxonomy])) {+				$settings['output_style'] = $settings['output_style_' . $taxonomy];+				$settings['icon_media_name'] = isset($settings['icon_media_name_' . $taxonomy]) ? $settings['icon_media_name_' . $taxonomy] : '';+				$settings['terms_box_color'] = isset($settings['terms_box_color_' . $taxonomy]) ? $settings['terms_box_color_' . $taxonomy] : array();+			}+		}+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped+		echo apply_filters('cubewp_shortcode_taxonomy_output', '', $settings);+	}++	private function cubewp_taxonomy_add_slider_controls()+	{+		$this->start_controls_section(+			'slider_style_section',+			[+				'label' => esc_html__('Terms Slider', 'cubewp-framework'),+				'tab' => \Elementor\Controls_Manager::TAB_CONTENT,+			]+		);++		$this->add_control(+			'cwp_enable_slider',+			[+				'label'        => esc_html__('Enable Slider', 'cubewp-framework'),+				'type'         => \Elementor\Controls_Manager::SWITCHER,+				'label_on'     => esc_html__('Yes', 'cubewp-framework'),+				'label_off'    => esc_html__('No', 'cubewp-framework'),+				'return_value' => 'yes',+				'default'      => '',+			]+		);+++		$this->add_responsive_control(+			'slider_post_spacing',+			[+				'label'        => esc_html__('Post Spacing', 'cubewp-framework'),+				'type'         => \Elementor\Controls_Manager::DIMENSIONS,+				'size_units'   => ['px', 'em', '%'],+				'selectors'  => [+					'{{WRAPPER}} .cubewp-term-slider .slick-slide>div ' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}} !important;',+					'{{WRAPPER}} .cwp-taxonomy-terms>div' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}} !important;',+				]+			]+		);++		$this->add_control('slides_to_show', array(+			'type'    => \Elementor\Controls_Manager::NUMBER,+			'label'   => esc_html__('Slides To Show', 'cubewp-framework'),+			'default' => 3,+			'min'     => 1,+			'max'     => 10,+			'step'    => 1,+			'description' => esc_html__('Number of slides to show at once in the slider.', 'cubewp-framework'),+			'condition'   => [+				'cwp_enable_slider' => 'yes',+			],+		));++		$this->add_control(+			'slides_to_scroll',+			[+				'type'    => \Elementor\Controls_Manager::NUMBER,+				'label'   => esc_html__('Slides To Scroll', 'cubewp-framework'),+				'default' => 1,+				'min'     => 1,+				'max'     => 10,+				'step'    => 1,+				'description' => esc_html__('Number of slides to scroll at once in the slider.', 'cubewp-framework'),+				'condition'   => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'autoplay',+			[+				'type'    => \Elementor\Controls_Manager::SWITCHER,+				'label'   => esc_html__('Autoplay', 'cubewp-framework'),+				'default' => 'yes',+				'description' => esc_html__('Enable or disable autoplay for the slider.', 'cubewp-framework'),+				'condition'   => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'autoplay_speed',+			[+				'type'    => \Elementor\Controls_Manager::NUMBER,+				'label'   => esc_html__('Autoplay Speed (ms)', 'cubewp-framework'),+				'default' => 2000,+				'min'     => 0,+				'step'    => 500,+				'description' => esc_html__('Set the speed for autoplay in milliseconds.', 'cubewp-framework'),+				'condition'   => [+					'cwp_enable_slider' => 'yes',+					'autoplay'      => 'yes',+				],+			]+		);++		$this->add_control(+			'speed',+			[+				'type'    => \Elementor\Controls_Manager::NUMBER,+				'label'   => esc_html__('Speed (ms)', 'cubewp-framework'),+				'default' => 500,+				'min'     => 0,+				'step'    => 100,+				'description' => esc_html__('Set the speed for the slider transition in milliseconds.', 'cubewp-framework'),+				'condition'   => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'fade_effect',+			[+				'type' => \Elementor\Controls_Manager::SWITCHER,+				'label' => esc_html__('Fade Effect', 'cubewp-framework'),+				'default' => '',+				'description' => esc_html__('Enable fade effect for slides transition.', 'cubewp-framework'),+				'condition' => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'infinite',+			[+				'type'    => \Elementor\Controls_Manager::SWITCHER,+				'label'   => esc_html__('Infinite Loop', 'cubewp-framework'),+				'default' => 'yes',+				'description' => esc_html__('Enable or disable infinite loop for the slider.', 'cubewp-framework'),+				'condition'   => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'variable_width',+			[+				'label' => __('Variable Width', 'cubewp-framework'),+				'type' => \Elementor\Controls_Manager::SWITCHER,+				'label_on' => __('Yes', 'cubewp-framework'),+				'label_off' => __('No', 'cubewp-framework'),+				'return_value' => 'yes',+				'default' => 'no',+				'condition'   => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'overflow_setting',+			[+				'label' => esc_html__('Overflow Setting', 'cubewp-framework'),+				'type' => \Elementor\Controls_Manager::SWITCHER,+				'condition' => [+					'cwp_enable_slider' => 'yes',+				],+				'selectors' => [+					'{{WRAPPER}} .cubewp-term-slider .slick-list.draggable' => 'overflow: inherit;',+				],+			]+		);++		$this->add_control(+			'enable_progress_bar',+			[+				'type' => \Elementor\Controls_Manager::SWITCHER,+				'label' => esc_html__('Enable Progress Bar', 'cubewp-framework'),+				'default' => '',+				'condition' => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_responsive_control(+			'progress_bar_height',+			[+				'label' => esc_html__('Progress Bar Height', 'cubewp-framework'),+				'type' => \Elementor\Controls_Manager::SLIDER,+				'size_units' => ['px'],+				'range' => [+					'px' => [+						'min' => 1,+						'max' => 50,+						'step' => 1,+					],+				],+				'default' => [+					'unit' => 'px',+					'size' => 5,+				],+				'selectors' => [+					'{{WRAPPER}} .slick-progress, {{WRAPPER}} .slick-progress .slick-progress-bar' => 'height: {{SIZE}}{{UNIT}};',+				],+				'condition' => [+					'cwp_enable_slider' => 'yes',+					'enable_progress_bar' => 'yes',+				],+			]+		);++		$this->add_responsive_control(+			'progress_bar_back_color',+			[+				'label' => esc_html__('Progress Bar Background Color', 'cubewp-framework'),+				'type' => \Elementor\Controls_Manager::COLOR,+				'default' => '#000000',+				'selectors' => [+					'{{WRAPPER}} .slick-progress' => 'background-color: {{VALUE}};',+				],+				'condition' => [+					'cwp_enable_slider' => 'yes',+					'enable_progress_bar' => 'yes',+				],+			]+		);++		$this->add_responsive_control(+			'progress_bar_color',+			[+				'label' => esc_html__('Progress Bar Fill Color', 'cubewp-framework'),+				'type' => \Elementor\Controls_Manager::COLOR,+				'default' => '#ddd',+				'selectors' => [+					'{{WRAPPER}} .slick-progress .slick-progress-bar' => 'background-color: {{VALUE}};',+				],+				'condition' => [+					'cwp_enable_slider' => 'yes',+					'enable_progress_bar' => 'yes',+				],+			]+		);++		$this->add_responsive_control(+			'scroll_bar_margin_top',+			[+				'label' => esc_html__('Progress Bar Margin Top', 'cubewp-framework'),+				'type' => \Elementor\Controls_Manager::SLIDER,+				'range' => [+					'px' => [+						'min' => -100,+						'max' => 100,+						'step' => 1,+					],+				],+				'default' => [+					'size' => '',+					'unit' => 'px',+				],+				'selectors' => [+					'{{WRAPPER}} .slick-progress' => 'margin-top: {{SIZE}}px;',+				],+				'condition' => [+					'cwp_enable_slider' => 'yes',+					'enable_progress_bar' => 'yes',+				],+			]+		);++		$this->add_control(+			'slider_dots_arrow_settings_divider',+			[+				'type' => \Elementor\Controls_Manager::DIVIDER,+				'style' => 'thick',+				'condition'   => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'custom_arrows',+			[+				'type' => \Elementor\Controls_Manager::SWITCHER,+				'label' => esc_html__('Enable Arrows', 'cubewp-framework'),+				'default' => 'yes',+				'condition' => [+					'cwp_enable_slider' => 'yes',+				],+			]+		);++		$this->add_control(+			'prev_icon',+			[+				'label' => __('Previous Icon', 'cubewp-framework'),

Let me analyze the provided diff for security vulnerabilities:

---

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE
XSS (Cross-Site Scripting) - CWE-79 - class-cubewp-elementor-taxonomy-widget.php - Line 627
Old Code:
```php
echo apply_filters('cubewp_shortcode_taxonomy_output', '', $settings);
```
Fixed Code:
```php
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters('cubewp_shortcode_taxonomy_output', '', $settings);
```
Explanation:
This line has a potential XSS vulnerability. The output from `apply_filters()` is echoed directly without any escaping. Although a `phpcs:ignore` comment was added, this is NOT a security fix—it's actually masking the vulnerability from code analysis tools. The filter `cubewp_shortcode_taxonomy_output` could return unescaped HTML/JavaScript from untrusted sources or user input. Proper security fixes would require using `wp_kses_post()`, `esc_html()`, or ensuring the filter always returns sanitized content. Simply suppressing the warning does not fix the underlying XSS risk.

---

**Vulnerability 2:**

Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - class-cubewp-elementor-taxonomy-widget.php - Line 619-620
Old Code:
```php
$args     = array(
    'taxonomy'        => $settings['taxonomy'],
```
Fixed Code:
```php
if (isset($settings['terms_per_page']) && $settings['terms_per_page'] === 'custom' && isset($settings['custom_terms_count']) && is_numeric($settings['custom_terms_count']) && $settings['custom_terms_count'] > 0) {
    $settings['terms_per_page'] = intval($settings['custom_terms_count']);
}
```
Explanation:
While the new validation for `custom_terms_count` is an improvement, the critical issue is that `$settings['taxonomy']` is used directly without any validation or sanitization. The taxonomy value comes from user-controllable settings and should be validated against the list of registered taxonomies using `taxonomy_exists()` before being used in WordPress functions like `get_term_by()`. This could lead to injection attacks or information disclosure.

---

**Vulnerability 3:**

Vulnerability Existed: not sure
Potential Information Disclosure - CWE-200 - class-cubewp-elementor-taxonomy-widget.php - Lines 621-626
Old Code:
```php
$args     = array(
    'taxonomy'        => $settings['taxonomy'],
    'terms_per_page'  => $settings['terms_per_page'],
    'output_style'    => $settings['output_style'],
    'child_terms'     => $settings['child_terms'],
    'hide_empty'      => $settings['hide_empty'],
    'icon_media_name' => $settings['icon_media_name'],
    'column_per_row'  => $settings['column_per_row'],
    'terms_box_color' => $settings['terms_box_color']
);
```
Fixed Code:
```php
$taxonomies = get_taxonomies();
foreach ($taxonomies as $taxonomy) {
    if (isset($settings['taxonomy']) && $settings['taxonomy'] == $taxonomy && isset($settings['output_style_' . $taxonomy])) {
        $settings['output_style'] = $settings['output_style_' . $taxonomy];
        $settings['icon_media_name'] = isset($settings['icon_media_name_' . $taxonomy]) ? $settings['icon_media_name_' . $taxonomy] : '';
        $settings['terms_box_color'] = isset($settings['terms_box_color_' . $taxonomy]) ? $settings['terms_box_color_' . $taxonomy] : array();
    }
}
```
Explanation:
The new code dynamically constructs setting keys using taxonomy names (e.g., `'output_style_' . $taxonomy`). While this provides better taxonomy-specific handling, it introduces complexity that could mask validation issues. However, the use of `isset()` checks provides some protection. The uncertainty stems from the shift in how settings are accessed—the original hardcoded settings approach had clearer boundaries than this dynamic key construction, though the new approach may actually be safer if all taxonomy values are properly validated upstream.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/vc-elements/class-cubewp-vc-posts-widget.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/vc-elements/class-cubewp-vc-posts-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -142,8 +142,8 @@ 			"heading"     => esc_html__( "Show Posts", "cubewp-framework" ), 			'save_always' => true, 			'value'       => array(-				esc_html__( "By Taxonomy" ) => "taxonomy",-				esc_html__( "By IDs" )      => "post_ids"+				esc_html__( "By Taxonomy", "cubewp-framework" ) => "taxonomy",+				esc_html__( "By IDs", "cubewp-framework" )      => "post_ids" 			), 			'dependency'  => array( 				'element' => 'posttype',@@ -254,6 +254,7 @@ 			} 		} +		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 		echo apply_filters( 'cubewp_shortcode_posts_output','', $args ); 	} }\ No newline at end of file

Vulnerability Existed: no
[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] - [CWE-79] - [cube/classes/page-builders/vc-elements/class-cubewp-vc-posts-widget.php] [Lines 257]

Old Code:
```
echo apply_filters( 'cubewp_shortcode_posts_output','', $args );
```

Fixed Code:
```
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters( 'cubewp_shortcode_posts_output','', $args );
```

Explanation:
The addition of the `phpcs:ignore` comment does not actually fix a security vulnerability—it merely suppresses a WordPress security linter warning. The underlying code still echoes the result of `apply_filters()` without escaping. However, the vulnerability was not introduced in this diff; it existed before. The diff does not remediate the XSS risk; it only acknowledges it via a linter suppression comment. If the filter is expected to return safe HTML (intentionally), this approach may be acceptable in context, but technically the output remains unescaped. This is a code quality change rather than a security fix.

---

Vulnerability Existed: no
[No Vulnerability] - [N/A] - [cube/classes/page-builders/vc-elements/class-cubewp-vc-posts-widget.php] [Lines 145-146]

Old Code:
```
esc_html__( "By Taxonomy" ) => "taxonomy",
esc_html__( "By IDs" )      => "post_ids"
```

Fixed Code:
```
esc_html__( "By Taxonomy", "cubewp-framework" ) => "taxonomy",
esc_html__( "By IDs", "cubewp-framework" )      => "post_ids"
```

Explanation:
This change adds the missing text domain parameter to the `esc_html__()` function calls. While not a security vulnerability fix, this is a best-practice improvement for WordPress localization. The strings will now be properly translatable with the correct text domain. The original code was functionally safe from a security perspective but incomplete for proper i18n support.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/page-builders/vc-elements/class-cubewp-vc-taxonomy-widget.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/page-builders/vc-elements/class-cubewp-vc-taxonomy-widget.php	2026-01-18 00:20:56.201778099 +0000@@ -147,6 +147,7 @@ 			'terms_box_color' => $terms_box_color 		); +		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 		echo apply_filters( 'cubewp_shortcode_taxonomy_output', '', $args ); 	} }\ No newline at end of file

```
Vulnerability Existed: no
Output Escaping Concern - CWE-79 (Cross-site Scripting) - class-cubewp-vc-taxonomy-widget.php - Line 150

Old Code:
echo apply_filters( 'cubewp_shortcode_taxonomy_output', '', $args );

Fixed Code:
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo apply_filters( 'cubewp_shortcode_taxonomy_output', '', $args );

Explanation:
This diff does not represent a security fix but rather a suppression of a WordPress coding standards warning. The addition of the phpcs:ignore comment tells the WordPress security scanner to ignore the "OutputNotEscaped" warning for this line. This is not a code change that removes a vulnerability—it's a directive that suppresses a linter warning without modifying the actual code logic. The vulnerability concern (potential XSS via unescaped filter output) continues to exist in the code. Whether this is truly vulnerable depends on whether the filter 'cubewp_shortcode_taxonomy_output' is guaranteed to return properly escaped content by its implementation. The phpcs:ignore suggests the developers believe the output is safe, but this is a suppression rather than an actual security fix.
```

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/shortcodes/class-cubewp-shortcode-posts.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/shortcodes/class-cubewp-shortcode-posts.php	2026-01-18 00:20:56.205778347 +0000@@ -1,10 +1,19 @@ <?php+/**+ * CubeWp Posts Shortcode.+ *+ * @version 1.0+ * @package cubewp/cube/classes+ */++// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ defined('ABSPATH') || exit;  /**- * CubeWP Posts Shortcode.+ * CubeWp Shortcode Posts.  *- * @class CubeWp_Frontend_Posts_Shortcode+ * @class CubeWp_Shortcode_Posts  */ class CubeWp_Shortcode_Posts {@@ -17,6 +26,14 @@ 		new CubeWp_Ajax('wp_ajax_nopriv_', 'CubeWp_Shortcode_Posts', 'cubewp_posts_output'); 		add_action('wp_enqueue_scripts', [$this, 'cubewp_enqueue_slick_for_elementor'], 999); 		add_action('elementor/editor/after_enqueue_scripts', [$this, 'cubewp_enqueue_slick_for_elementor']);++		// Cache invalidation hooks+		add_action('save_post', array($this, 'clear_posts_cache'), 10, 1);+		add_action('delete_post', array($this, 'clear_posts_cache'), 10, 1);+		add_action('wp_trash_post', array($this, 'clear_posts_cache'), 10, 1);+		add_action('untrash_post', array($this, 'clear_posts_cache'), 10, 1);+		add_action('elementor/document/before_save', array($this, 'clear_elementor_cache'), 10, 2);+		add_action('elementor/document/after_save', array($this, 'clear_elementor_cache'), 10, 2); 	}  	public static function cubewp_posts($output, array $parameters)@@ -26,10 +43,17 @@ 			CubeWp_Enqueue::enqueue_style('cubewp-slick'); 			CubeWp_Enqueue::enqueue_script('cubewp-slick'); 		}-		if (cubewp_is_elementor_editing()) {++		$load_via_ajax = isset($parameters['load_via_ajax']) ? $parameters['load_via_ajax'] : 'yes';+		if ($load_via_ajax !== 'yes' || cubewp_is_elementor_editing()) { 			return self::cubewp_posts_output($parameters); 		} +		$is_load_more = isset($parameters['load_more']) && $parameters['load_more'] === 'yes';+		if ($is_load_more) {+			CubeWp_Enqueue::enqueue_script('cwp-load-more');+		}+ 		$slides_to_show = isset($parameters['slides_to_show']) ? intval($parameters['slides_to_show']) : 3; 		$slides_to_show_tablet = isset($parameters['slides_to_show_tablet']) ? intval($parameters['slides_to_show_tablet']) : 2; 		$slides_to_show_mobile = isset($parameters['slides_to_show_mobile']) ? intval($parameters['slides_to_show_mobile']) : 1;@@ -38,8 +62,8 @@ 		$posts_per_row = isset($parameters['posts_per_row']) ? $parameters['posts_per_row'] : 'auto'; 		$posts_per_row_tablet = (isset($parameters['posts_per_row_tablet']) && $parameters['posts_per_row_tablet'] !== 'auto') ? $parameters['posts_per_row_tablet'] : 3; 		$posts_per_row_mobile = (isset($parameters['posts_per_row_mobile']) && $parameters['posts_per_row_mobile'] !== 'auto') ? $parameters['posts_per_row_mobile'] : 2;-		-		if($cwp_enable_slider){++		if ($cwp_enable_slider) { 			$processing_grids_per_row = $slides_to_show; 			$posts_per_row_tablet = $slides_to_show_tablet; 			$posts_per_row_mobile = $slides_to_show_mobile;@@ -55,7 +79,9 @@ 		$unique_id = uniqid('cubewp_posts_');  		// Container start-		$output .= '<div id="' . esc_attr($unique_id) . '" class="cubewp-ajax-posts-container" data-parameters="' . htmlspecialchars(json_encode($parameters), ENT_QUOTES, 'UTF-8') . '">+		$params_with_nonce = $parameters;+		$params_with_nonce['nonce'] = wp_create_nonce('cubewp_posts_output');+		$output .= '<div id="' . esc_attr($unique_id) . '" class="cubewp-ajax-posts-container" data-parameters="' . htmlspecialchars(json_encode($params_with_nonce), ENT_QUOTES, 'UTF-8') . '">         <div class="cubewp-processing-posts-container" style="display: flex; flex-wrap: wrap; gap: 10px;">';  		for ($i = 0; $i < $processing_grid_count; $i++) {@@ -112,8 +138,35 @@  	public static function cubewp_posts_output($parameters) 	{-		if (wp_doing_ajax() && isset($_REQUEST['action']) && $_REQUEST['action'] === 'cubewp_posts_output' && !cubewp_is_elementor_editing()) {-			$parameters = $_POST;+		if (wp_doing_ajax() && !cubewp_is_elementor_editing()) {+			check_ajax_referer('cubewp_posts_output', 'nonce');+			$parameters = isset($_POST) ? wp_unslash($_POST) : array();+		}++		// Check if cache is enabled+		$cache_enabled = self::is_cache_enabled();++		// Check cache first (skip cache for AJAX requests, load more requests, and Elementor editor)+		$is_ajax_request = wp_doing_ajax();+		$is_load_more = isset($parameters['load_more']) && $parameters['load_more'] === 'yes';+		$skip_cache = $is_ajax_request || $is_load_more || cubewp_is_elementor_editing() || !$cache_enabled;++		$loadbyclick = true;+		if (isset($parameters['sendby']) && $parameters['sendby'] === 'load_more') {+			$loadbyclick = false;+		}++		if (!$skip_cache) {+			$cache_key = self::get_cache_key($parameters);+			$cached_content = self::get_cache($cache_key);++			if ($cached_content !== false) {+				// Return cached content+				if (is_array($cached_content)) {+					return $cached_content['content'] . (isset($cached_content['load_btn']) ? $cached_content['load_btn'] : '');+				}+				return $cached_content;+			} 		}  		$cwp_enable_slider = isset($parameters['cwp_enable_slider']) ? $parameters['cwp_enable_slider'] : '';@@ -131,13 +184,13 @@ 			$autoplay = isset($parameters['autoplay']) ? $parameters['autoplay'] : 'false'; 			$autoplay_speed = isset($parameters['autoplay_speed']) ? intval($parameters['autoplay_speed']) : 2000; 			$speed = isset($parameters['speed']) ? intval($parameters['speed']) : 500;-			$infinite = (isset($parameters['infinite']) && $parameters['infinite'] === 'true') ? 'true' : 'false';-			$fade_effect = (isset($parameters['fade_effect']) && $parameters['fade_effect'] === 'true') ? 'true' : 'false';-			$variable_width = (isset($parameters['variable_width']) && $parameters['variable_width'] === 'true') ? 'true' : 'false';-			$custom_arrows = (isset($parameters['custom_arrows']) && $parameters['custom_arrows'] === 'true') ? 'true' : 'false';-			$enable_progress_bar = (isset($parameters['enable_progress_bar']) && $parameters['enable_progress_bar'] === 'true') ? 'true' : 'false';-			$custom_dots = (isset($parameters['custom_dots']) && $parameters['custom_dots'] === 'true') ? 'true' : 'false';-			$enable_wrap_dots_arrows = (isset($parameters['enable_wrap_dots_arrows']) && $parameters['enable_wrap_dots_arrows'] === 'true') ? 'true' : 'false';+			$infinite = (isset($parameters['infinite']) && $parameters['infinite'] === true) ? 'true' : 'false';+			$fade_effect = (isset($parameters['fade_effect']) && $parameters['fade_effect'] === true) ? 'true' : 'false';+			$variable_width = (isset($parameters['variable_width']) && $parameters['variable_width'] === true) ? 'true' : 'false';+			$custom_arrows = (isset($parameters['custom_arrows']) && $parameters['custom_arrows'] === true) ? 'true' : 'false';+			$enable_progress_bar = (isset($parameters['enable_progress_bar']) && $parameters['enable_progress_bar'] === true) ? 'true' : 'false';+			$custom_dots = (isset($parameters['custom_dots']) && $parameters['custom_dots'] === true) ? 'true' : 'false';+			$enable_wrap_dots_arrows = (isset($parameters['enable_wrap_dots_arrows']) && $parameters['enable_wrap_dots_arrows'] === true) ? 'true' : 'false'; 		} 		$promotional_card = $parameters['promotional_card']; 		$promotional_card_list = $parameters['promotional_cards'];@@ -147,10 +200,10 @@ 			'orderby'        => $parameters['orderby'], 			'order'          => $parameters['order'], 			'page_num'          => 1,-			'meta_query'     => isset($parameters['meta_query']) ? $parameters['meta_query'] : array(),+			'meta_query'     => isset($parameters['meta_query']) ? $parameters['meta_query'] : array(), // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 		); -		if (isset($parameters['number_of_posts']) && $parameters['number_of_posts'] !== '') {+		if (isset($parameters['number_of_posts']) && $parameters['number_of_posts'] !== '' && intval($parameters['number_of_posts']) !== -1) { 			$args['posts_per_page'] = intval($parameters['number_of_posts']); 		} elseif (isset($parameters['posts_per_page']) && $parameters['posts_per_page'] !== '') { 			$args['posts_per_page'] = intval($parameters['posts_per_page']);@@ -237,15 +290,24 @@ 		$container_open = '<div class="cubewp-posts-shortcode cwp-row ' . esc_attr($slider_class) . '"'; 		if ($cwp_enable_slider) { -			$prev_icon = self::cubewp_get_svg_content($prev_icon);-			$next_icon = self::cubewp_get_svg_content($next_icon);+			$prev_icon = cubewp_get_svg_content($prev_icon);+			$next_icon = cubewp_get_svg_content($next_icon); -			$is_prev_svg = strpos(trim($prev_icon), '<svg') === 0;-			$is_next_svg = strpos(trim($next_icon), '<svg') === 0;+			// Ensure icons are strings (handle any edge cases - should not be needed after fix, but safety check)+			if (is_array($prev_icon)) {+				$prev_icon = isset($prev_icon['value']) ? $prev_icon['value'] : (isset($prev_icon['url']) ? $prev_icon['url'] : '');+			}+			if (is_array($next_icon)) {+				$next_icon = isset($next_icon['value']) ? $next_icon['value'] : (isset($next_icon['url']) ? $next_icon['url'] : '');+			}+			$prev_icon = is_string($prev_icon) ? $prev_icon : '';+			$next_icon = is_string($next_icon) ? $next_icon : ''; -			if ($is_prev_svg) {+			$is_prev_svg = (is_string($prev_icon) && strpos(trim($prev_icon), '<svg') === 0);+			$is_next_svg = (is_string($next_icon) && strpos(trim($next_icon), '<svg') === 0); -				$container_open .= " data-prev-arrow-svg='" . $prev_icon . "'";+			if ($is_prev_svg) {+				$container_open .= " data-prev-arrow-svg='" . esc_attr($prev_icon) . "'"; 				$container_open .= ' data-is-prev-svg="true"'; 			} else { 				$container_open .= ' data-prev-arrow="' . esc_attr($prev_icon) . '"';@@ -253,7 +315,7 @@ 			}  			if ($is_next_svg) {-				$container_open .= " data-next-arrow-svg='" . $next_icon . "'";+				$container_open .= " data-next-arrow-svg='" . esc_attr($next_icon) . "'"; 				$container_open .= ' data-is-next-svg="true"'; 			} else { 				$container_open .= ' data-next-arrow="' . esc_attr($next_icon) . '"';@@ -287,13 +349,18 @@ 		$counter        = 1; 		$has_more_posts = false; 		if ($posts->have_posts()) {+			global $post; 			if ($posts_row_class) { 				add_filter('post_class', function ($classes) use ($posts_row_class) { 					$classes[] = $posts_row_class; 					return $classes; 				}); 			}-			$post_markup = $container_open;+			if ($loadbyclick) {+				$post_markup = $container_open;+			} else {+				$post_markup = '';+			} 			$promotional_cards = []; 			if ($promotional_card && !empty($promotional_card_list) && is_array($promotional_card_list)) { 				foreach ($promotional_card_list as $promotional_card) {@@ -342,35 +409,66 @@ 				endwhile; 			} 			if (isset($parameters['load_more']) && $parameters['load_more'] == 'yes') {-				if (isset($parameters['page_num'])) {-					$parameters['page_num'] = $parameters['page_num'] + 1;-				} else {-					$parameters['page_num'] = 2;-				}-				$has_more_posts = $args['page_num'] < $posts->max_num_pages;++				// Get current page number for pagination check+				$current_page = isset($parameters['page_num']) ? intval($parameters['page_num']) : 1;++				// Check if there are more posts available+				$has_more_posts = $current_page < $posts->max_num_pages;++				// Prepare parameters for next page (for load more button) +				$parameters['page_num'] = $current_page + 1; 				$dataAttributes = json_encode($parameters);-				CubeWp_Enqueue::enqueue_script('cwp-load-more'); +				CubeWp_Enqueue::enqueue_script('cwp-load-more'); -				$load_btn .= '<div class="cubewp-load-more-conatiner">-					<button class="cubewp-load-more-button" data-attributes="' . htmlspecialchars($dataAttributes, ENT_QUOTES, 'UTF-8') . '">-						' . esc_html__('Load More', 'cubewp-framework') . '-					</button>-				</div>';+				if ($has_more_posts) {+					$load_btn .= '<div class="cubewp-load-more-conatiner">+						<button class="cubewp-load-more-button" data-attributes="' . htmlspecialchars($dataAttributes, ENT_QUOTES, 'UTF-8') . '">+							' . esc_html__('Load More', 'cubewp-framework') . '+						</button>+					</div>';+				} else {+					// No more posts, keep original parameters+					$next_page_params = $parameters;+				}+			} else {+				// Load more not enabled, keep original parameters+				$next_page_params = $parameters;+			}+			if ($loadbyclick) {+				$post_markup .= $container_close; 			}-			$post_markup .= $container_close; 			if ($posts_row_class) { 				remove_all_filters('post_class'); // or remove using the closure reference if needed 			} 		} else { 			$post_markup = self::cwp_no_result_found(); 		}-		wp_reset_query();+		wp_reset_postdata();++		$final_output = $post_markup . $load_btn; -		if (wp_doing_ajax() && isset($_REQUEST['action']) && $_REQUEST['action'] === 'cubewp_posts_output' && !cubewp_is_elementor_editing()) {-			wp_send_json_success(array('content' => $post_markup, 'newAttributes' => $parameters, 'has_more_posts' => $has_more_posts));+		// Cache the output if not AJAX and not Elementor editor and cache is enabled+		if (!$skip_cache && $cache_enabled) {+			$cache_key = self::get_cache_key($parameters);+			$cache_data = array(+				'content' => $post_markup,+				'load_btn' => $load_btn,+				'has_more_posts' => $has_more_posts,+				'newAttributes' => isset($next_page_params) ? $next_page_params : $parameters+			);+			// Get cache TTL from settings (in hours, convert to seconds)+			$cache_ttl_hours = self::get_cache_ttl_hours();+			self::set_cache($cache_key, $cache_data, $cache_ttl_hours * HOUR_IN_SECONDS);+		}++++		if (wp_doing_ajax() && !cubewp_is_elementor_editing()) {+			wp_send_json_success(array('content' => $final_output, 'newAttributes' => $parameters, 'has_more_posts' => $has_more_posts)); 		} else {-			return $post_markup . $load_btn;+			return $final_output; 		} 	} @@ -389,7 +487,9 @@ 		} 		if (isset($parameters['load_via_ajax']) && $parameters['load_via_ajax'] === 'yes' && !wp_doing_ajax()) { 			$unique_id = uniqid('cubewp_posts_');-			$output .= '<div id="' . esc_attr($unique_id) . '" class="cubewp-ajax-posts-container" data-parameters="' . wp_json_encode($parameters) . '">+			$params_with_nonce = $parameters;+			$params_with_nonce['nonce'] = wp_create_nonce('cubewp_posts_output');+			$output .= '<div id="' . esc_attr($unique_id) . '" class="cubewp-ajax-posts-container" data-parameters="' . wp_json_encode($params_with_nonce) . '">                             <div class="cubewp-processing-card">                                 <div class="cubewp-processing-card-inner">                                     <div class="cubewp-processing-card-icon">@@ -421,36 +521,17 @@ 		return '<div class="cwp-empty-search"><img class="cwp-empty-search-img" src="' . esc_url(CWP_PLUGIN_URI . 'cube/assets/frontend/images/no-result.png') . '" alt=""><h2>' . esc_html__('No Results Found', 'cubewp-framework') . '</h2><p>' . esc_html__('There are no results matching your search.', 'cubewp-framework') . '</p></div>'; 	} -	private static function cubewp_get_svg_content($icon)-	{-		// If icon is array with 'url', fetch the content-		if (is_array($icon) && isset($icon['url'])) {-			$response = wp_safe_remote_get($icon['url']);-			if (!is_wp_error($response) && 200 === wp_remote_retrieve_response_code($response)) {-				return wp_remote_retrieve_body($response);-			}-			return ''; // fallback if fetch fails-		}--		// If icon is string, return it-		if (is_string($icon)) {-			return $icon;-		}--		return ''; // fallback-	}- 	public function cubewp_enqueue_slick_for_elementor() 	{ 		$is_elementor_editor = false;  		// Method 1: Check URL parameters-		if (isset($_GET['action']) && $_GET['action'] === 'elementor') {+		if (isset($_GET['action']) && $_GET['action'] === 'elementor') { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check for Elementor editor state. 			$is_elementor_editor = true; 		}  		// Method 2: Check for elementor-preview parameter-		if (isset($_GET['elementor-preview'])) {+		if (isset($_GET['elementor-preview'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check for Elementor editor state. 			$is_elementor_editor = true; 		} @@ -470,4 +551,213 @@ 			CubeWp_Enqueue::enqueue_script('cubewp-slick'); 		} 	}+	/**+	 * Check if posts cache is enabled from settings+	 * +	 * @return bool True if cache is enabled+	 */+	private static function is_cache_enabled()+	{+		global $cwpOptions;+		if (empty($cwpOptions)) {+			$cwpOptions = get_option('cwpOptions', array());+		}++		// Default to enabled if not set+		$enabled = isset($cwpOptions['cwp_posts_enable_cache']) ? !empty($cwpOptions['cwp_posts_enable_cache']) : true;++		/**+		 * Filter whether posts caching should be enabled.+		 *+		 * @param bool $enabled+		 */+		return (bool) apply_filters('cubewp/posts/cache_enabled', $enabled);+	}++	/**+	 * Get cache TTL in hours from settings+	 * +	 * @return int Cache TTL in hours (default: 12)+	 */+	private static function get_cache_ttl_hours()+	{+		global $cwpOptions;+		if (empty($cwpOptions)) {+			$cwpOptions = get_option('cwpOptions', array());+		}++		// Default to 12 hours if not set+		$ttl_hours = isset($cwpOptions['cwp_posts_cache_ttl']) ? intval($cwpOptions['cwp_posts_cache_ttl']) : 12;++		// Ensure minimum of 1 hour+		if ($ttl_hours < 1) {+			$ttl_hours = 12;+		}++		/**+		 * Filter the cache TTL for posts output.+		 *+		 * @param int $ttl_hours Cache TTL in hours+		 */+		return (int) apply_filters('cubewp/posts/cache_ttl_hours', $ttl_hours);+	}++	/**+	 * Generate cache key based on query parameters+	 * +	 * @param array $parameters Query parameters+	 * @return string Cache key+	 */+	private static function get_cache_key($parameters)+	{+		// Create a unique key based on all relevant parameters+		$key_parts = array(+			'cubewp_posts',+			isset($parameters['post_type']) ? $parameters['post_type'] : 'post',+			isset($parameters['orderby']) ? $parameters['orderby'] : 'date',+			isset($parameters['order']) ? $parameters['order'] : 'DESC',+			isset($parameters['posts_per_page']) ? $parameters['posts_per_page'] : (isset($parameters['number_of_posts']) ? $parameters['number_of_posts'] : 10),+			isset($parameters['page_num']) ? $parameters['page_num'] : 1,+			isset($parameters['post__in']) ? md5(serialize($parameters['post__in'])) : '',+			isset($parameters['taxonomy']) ? md5(serialize($parameters['taxonomy'])) : '',+			isset($parameters['meta_query']) ? md5(serialize($parameters['meta_query'])) : '',+			isset($parameters['layout']) ? $parameters['layout'] : 'grid',+			isset($parameters['card_style']) ? md5(serialize($parameters['card_style'])) : '',+		);++		// Include site URL to make cache unique per site+		$key_parts[] = get_site_url();++		// Convert all values to strings to avoid array to string conversion errors+		$key_parts = array_map(function ($value) {+			if (is_array($value) || is_object($value)) {+				return md5(serialize($value));+			}+			return (string) $value;+		}, $key_parts);++		return 'cubewp_posts_' . md5(implode('|', $key_parts));+	}++	/**+	 * Get cached content based on cache type (automatically detects wp_using_ext_object_cache)+	 * +	 * @param string $cache_key Cache key+	 * @return mixed Cached content or false if not found+	 */+	private static function get_cache($cache_key)+	{+		// Automatically detect if external object cache is available+		if (wp_using_ext_object_cache()) {+			// Use object cache+			// Check cache version for compatibility with older WordPress+			$cache_version_key = 'cubewp_posts_version';+			$cache_version = wp_cache_get($cache_version_key, 'cubewp_posts');+			if ($cache_version === false) {+				$cache_version = 1;+				wp_cache_set($cache_version_key, $cache_version, 'cubewp_posts', 0);+			}++			// Include version in cache key for invalidation support+			$versioned_cache_key = $cache_key . '_v' . $cache_version;++			return wp_cache_get($versioned_cache_key, 'cubewp_posts');+		} else {+			// Use SQL cache (transients) when object cache is not available+			return get_transient($cache_key);+		}+	}++	/**+	 * Set cached content based on cache type (automatically detects wp_using_ext_object_cache)+	 * +	 * @param string $cache_key Cache key+	 * @param mixed $cache_data Data to cache+	 * @param int $expiration Expiration time in seconds+	 */+	private static function set_cache($cache_key, $cache_data, $expiration)+	{+		// Automatically detect if external object cache is available+		if (wp_using_ext_object_cache()) {+			// Use object cache+			// Get cache version for compatibility with older WordPress+			$cache_version_key = 'cubewp_posts_version';+			$cache_version = wp_cache_get($cache_version_key, 'cubewp_posts');+			if ($cache_version === false) {+				$cache_version = 1;+				wp_cache_set($cache_version_key, $cache_version, 'cubewp_posts', 0);+			}++			// Include version in cache key for invalidation support+			$versioned_cache_key = $cache_key . '_v' . $cache_version;+			wp_cache_set($versioned_cache_key, $cache_data, 'cubewp_posts', $expiration);+		} else {+			// Use SQL cache (transients) when object cache is not available+			set_transient($cache_key, $cache_data, $expiration);+		}+	}++	/**+	 * Clear cache when post is updated/deleted+	 * Automatically detects cache type using wp_using_ext_object_cache()+	 * +	 * @param int $post_id Post ID+	 */+	public function clear_posts_cache($post_id)+	{+		// Automatically detect if external object cache is available+		if (wp_using_ext_object_cache()) {+			// Clear object cache+			// WordPress 6.1+ supports wp_cache_flush_group, otherwise we need to track keys+			if (function_exists('wp_cache_flush_group')) {+				// Flush entire cache group (most efficient)+				wp_cache_flush_group('cubewp_posts');+			} else {+				// Fallback: Clear cache by pattern (requires tracking or clearing all)+				// For older WordPress versions, we'll use a cache versioning approach+				$cache_version_key = 'cubewp_posts_version';+				$current_version = wp_cache_get($cache_version_key, 'cubewp_posts');+				if ($current_version === false) {+					$current_version = 1;+				}+				// Increment version to invalidate all caches+				wp_cache_set($cache_version_key, $current_version + 1, 'cubewp_posts', 0);+			}+		} else {+			// Clear SQL cache (transients) when object cache is not available+			global $wpdb;++			// Get all transients with our cache prefix+			$cache_keys = $wpdb->get_col( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.NotPrepared -- Controlled internal query to enumerate plugin-specific transient keys for cleanup when object cache is unavailable.+				"SELECT option_name +				FROM {$wpdb->options} +				WHERE option_name LIKE '_transient_cubewp_posts_%' +				OR option_name LIKE '_transient_timeout_cubewp_posts_%'"+			);++			foreach ($cache_keys as $cache_key) {+				// Remove _transient_ or _transient_timeout_ prefix+				$transient_name = str_replace(array('_transient_', '_transient_timeout_'), '', $cache_key);+				delete_transient($transient_name);+			}+		}+	}++	/**+	 * Clear cache when Elementor template is updated+	 * +	 * @param object $document Elementor document+	 * @param array $data Document data+	 */+	public function clear_elementor_cache($document, $data = array())+	{+		// Check if it's a post card template+		$post_id = $document->get_main_id();+		$template_type = get_post_meta($post_id, 'template_type', true);++		if ($template_type === 'postcard') {+			// Clear all post caches when post card template is updated+			$this->clear_posts_cache($post_id);+		}+	} }

I'll analyze this code diff for security vulnerabilities.

Vulnerability 1:
    Vulnerability Existed: yes
FALSE POSITIVE
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - class-cubewp-shortcode-posts.php - Lines 82, 318
    [Old Code]
    $output .= '<div id="' . esc_attr($unique_id) . '" class="cubewp-ajax-posts-container" data-parameters="' . htmlspecialchars(json_encode($parameters), ENT_QUOTES, 'UTF-8') . '">'
    [Fixed Code]
    $params_with_nonce = $parameters;
    $params_with_nonce['nonce'] = wp_create_nonce('cubewp_posts_output');
    $output .= '<div id="' . esc_attr($unique_id) . '" class="cubewp-ajax-posts-container" data-parameters="' . htmlspecialchars(json_encode($params_with_nonce), ENT_QUOTES, 'UTF-8') . '">'
    Explanation:
    The original code passed unsanitized user parameters directly into JSON encoding. While `htmlspecialchars()` provides some protection, the parameters could contain malicious data. The fix adds CSRF protection via `wp_create_nonce()`, though the primary XSS mitigation comes from proper escaping with `htmlspecialchars()` and `ENT_QUOTES`. The fix is incomplete from an XSS perspective—`wp_json_encode()` with proper context-specific escaping would be more appropriate than `htmlspecialchars()` with JSON.

Vulnerability 2:
    Vulnerability Existed: yes
TRUE POSITIVE
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - class-cubewp-shortcode-posts.php - Lines 305-313
    [Old Code]
    $prev_icon = self::cubewp_get_svg_content($prev_icon);
    $next_icon = self::cubewp_get_svg_content($next_icon);
    $is_prev_svg = strpos(trim($prev_icon), '<svg') === 0;
    $is_next_svg = strpos(trim($next_icon), '<svg') === 0;
    if ($is_prev_svg) {
        $container_open .= " data-prev-arrow-svg='" . $prev_icon . "'";
    }
    [Fixed Code]
    if (is_array($prev_icon)) {
        $prev_icon = isset($prev_icon['value']) ? $prev_icon['value'] : (isset($prev_icon['url']) ? $prev_icon['url'] : '');
    }
    if (is_array($next_icon)) {
        $next_icon = isset($next_icon['value']) ? $next_icon['value'] : (isset($next_icon['url']) ? $next_icon['url'] : '');
    }
    $prev_icon = is_string($prev_icon) ? $prev_icon : '';
    $next_icon = is_string($next_icon) ? $next_icon : '';
    $is_prev_svg = (is_string($prev_icon) && strpos(trim($prev_icon), '<svg') === 0);
    $is_next_svg = (is_string($next_icon) && strpos(trim($next_icon), '<svg') === 0);
    if ($is_prev_svg) {
        $container_open .= " data-prev-arrow-svg='" . esc_attr($prev_icon) . "'";
    }
    [Fixed Code Line 318]
    $container_open .= " data-next-arrow-svg='" . esc_attr($next_icon) . "'";
    Explanation:
    The old code directly embedded SVG content into HTML attributes without escaping: `$prev_icon . "'"`. This allowed arbitrary HTML/SVG injection. The fix adds `esc_attr()` escaping on lines 310 and 318, properly sanitizing the SVG data for safe attribute inclusion. The type checking ensures variables are strings before processing, preventing type confusion vulnerabilities.

Vulnerability 3:
    Vulnerability Existed: yes
FALSE POSITIVE
    Improper Neutralization of Special Elements used in an SQL Statement ('SQL Injection') - CWE-89 - class-cubewp-shortcode-posts.php - Lines 142-144
    [Old Code]
    if (wp_doing_ajax() && isset($_REQUEST['action']) && $_REQUEST['action'] === 'cubewp_posts_output' && !cubewp_is_elementor_editing()) {
        $parameters = $_POST;
    }
    [Fixed Code]
    if (wp_doing_ajax() && !cubewp_is_elementor_editing()) {
        check_ajax_referer('cubewp_posts_output', 'nonce');
        $parameters = isset($_POST) ? wp_unslash($_POST) : array();
    }
    Explanation:
    The old code accepted `$_POST` directly without CSRF validation or unslashing. While not direct SQL injection, unsanitized `$_POST` values passed to WP_Query could become injection vectors through `meta_query` parameters. The fix adds `check_ajax_referer()` for CSRF protection and `wp_unslash()` for proper data handling, reducing attack surface.

Vulnerability 4:
    Vulnerability Existed: yes
FALSE POSITIVE
    Improper Restriction of XML External Entity Reference - CWE-611 - class-cubewp-shortcode-posts.php - Lines 522-535
    [Old Code]
    private static function cubewp_get_svg_content($icon)
    {
        if (is_array($icon) && isset($icon['url'])) {
            $response = wp_safe_remote_get($icon['url']);
            if (!is_wp_error($response) && 200 === wp_remote_retrieve_response_code($response)) {
                return wp_remote_retrieve_body($response);
            }
            return '';
        }
        if (is_string($icon)) {
            return $icon;
        }
        return '';
    }
    [Fixed Code]
    [Function removed - no longer used]
    Explanation:
    The removed function fetched SVG content from URLs without validation, creating XXE vulnerability potential if the fetched SVG contained XML entities. It also allowed SSRF attacks by accepting arbitrary URLs. The fix removes this dangerous function entirely, replacing inline icon handling with type-checked, escaped attributes instead.

Vulnerability 5:
    Vulnerability Existed: yes
FALSE POSITIVE
    Improper Access Control / Missing Authorization - CWE-862 - class-cubewp-shortcode-posts.php - Line 545
    [Old Code]
    if (isset($_GET['action']) && $_GET['action'] === 'elementor') {
        $is_elementor_editor = true;
    }
    if (isset($_GET['elementor-preview'])) {
        $is_elementor_editor = true;
    }
    [Fixed Code]
    if (isset($_GET['action']) && $_GET['action'] === 'elementor') { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check for Elementor editor state.
        $is_elementor_editor = true;
    }
    if (isset($_GET['elementor-preview'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check for Elementor editor state.
        $is_elementor_editor = true;
    }
    Explanation:
    The old code checked `$_GET` parameters for detecting Elementor editor mode. While the fix adds phpcs ignore comments, this is not a complete security fix—these are read-only checks that determine UI behavior, not security decisions. The comments correctly document this is intentional, but the actual vulnerability (trusting unvalidated GET parameters for feature detection) remains. A proper fix would verify nonces or user capabilities.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/shortcodes/class-cubewp-shortcode-search.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/shortcodes/class-cubewp-shortcode-search.php	2026-01-18 00:20:56.205778347 +0000@@ -22,8 +22,6 @@ 	public function __construct()
 	{
 		add_filter('cubewp_search_shortcode_output', array($this, 'cubewp_search'), 10, 2);
-		add_filter('cubewp/frontend/search/button/field', array($this, 'cubewp_search_button'), 11, 2);
-		add_filter('cubewp/frontend/search/form', array($this, 'cubewp_search_form_container'), 11, 3);
 	}
 
 
@@ -36,6 +34,8 @@ 
 	public function cubewp_search($output, $atts)
 	{
+		add_filter('cubewp/frontend/search/button/field', array($this, 'cubewp_search_button'), 11, 2);
+		add_filter('cubewp/frontend/search/form', array($this, 'cubewp_search_form_container'), 11, 3);
 
 		$get_post_type = isset($atts['post_type']) ? $atts['post_type'] : 'post';
 		$submit_button_icon = isset($atts['submit_button_icon']) ? $atts['submit_button_icon'] : '';
@@ -79,7 +79,7 @@ 				$active = $index === 0 ? 'active' : '';
 				$aria_selected = $index === 0 ? 'true' : 'false';
 				echo '<li class="nav-item" role="presentation">';
-				echo '<button class="tabber-btn nav-link ' . $active . '" id="tab-' . esc_attr($post_type) . '" data-bs-toggle="tab" data-bs-target="#tab-content-' . esc_attr($post_type) . '" type="button" role="tab" aria-controls="tab-content-' . esc_attr($post_type) . '" aria-selected="' . $aria_selected . '">' . $tab_icon_html . ' ' . esc_html($title) . '</button>';
+				echo '<button class="tabber-btn nav-link ' . esc_attr($active) . '" id="tab-' . esc_attr($post_type) . '" data-bs-toggle="tab" data-bs-target="#tab-content-' . esc_attr($post_type) . '" type="button" role="tab" aria-controls="tab-content-' . esc_attr($post_type) . '" aria-selected="' . esc_attr($aria_selected) . '">' . /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ $tab_icon_html . ' ' . esc_html($title) . '</button>';
 				echo '</li>';
 			}
 			echo '</ul>';
@@ -88,7 +88,7 @@ 			echo '<div class="tab-content" id="cubewp_searchTabContent">';
 			foreach ($post_types as $index => $post_type) {
 				$active = $index === 0 ? 'show active' : '';
-				echo '<div class="tab-pane fade ' . $active . '" id="tab-content-' . esc_attr($post_type) . '" role="tabpanel" aria-labelledby="tab-' . esc_attr($post_type) . '">';
+				echo '<div class="tab-pane fade ' . esc_attr($active) . '" id="tab-content-' . esc_attr($post_type) . '" role="tabpanel" aria-labelledby="tab-' . esc_attr($post_type) . '">';
 				echo do_shortcode('[cwpSearch type="' . esc_attr($post_type) . '"]');
 				echo '</div>';
 			}
@@ -125,14 +125,15 @@ 		$form_id                  =  isset($cwp_search_fields[$type]['form']['form_id'])              ? $cwp_search_fields[$type]['form']['form_id']                : 'cwp-search-' . $type;
 
 
-		$html = '<div class="cwp-frontend-search-form ' . esc_attr($form_container_class) . '">
+		$html = '<div class="cwp-frontend-form-container">
+		<div class="cwp-frontend-search-form ' . esc_attr($form_container_class) . '">
             <form method="GET" id="' . esc_attr($form_id) . '" class="' . esc_attr($form_class) . '" action="' . esc_url(home_url('/')) . '" class="cwp-search-form">
                 <input type="hidden" name="post_type" value="' . esc_attr($type) . '">';
 
 		$html .= $this->cubewp_frontend_search_form_fields($search_fields , $params);
 
 		$html .= '</form>
-        </div>';
+        </div></div>';
 
 
 		return $html;

I'll analyze this code diff for security vulnerabilities following the specified format.

---

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE

**Cross-Site Scripting (XSS) - CWE-79** - cube/classes/shortcodes/class-cubewp-shortcode-search.php - Lines 82, 91

**Old Code:**
```php
echo '<button class="tabber-btn nav-link ' . $active . '" id="tab-' . esc_attr($post_type) . '" data-bs-toggle="tab" data-bs-target="#tab-content-' . esc_attr($post_type) . '" type="button" role="tab" aria-controls="tab-content-' . esc_attr($post_type) . '" aria-selected="' . $aria_selected . '">' . $tab_icon_html . ' ' . esc_html($title) . '</button>';

echo '<div class="tab-pane fade ' . $active . '" id="tab-content-' . esc_attr($post_type) . '" role="tabpanel" aria-labelledby="tab-' . esc_attr($post_type) . '">';
```

**Fixed Code:**
```php
echo '<button class="tabber-btn nav-link ' . esc_attr($active) . '" id="tab-' . esc_attr($post_type) . '" data-bs-toggle="tab" data-bs-target="#tab-content-' . esc_attr($post_type) . '" type="button" role="tab" aria-controls="tab-content-' . esc_attr($post_type) . '" aria-selected="' . esc_attr($aria_selected) . '">' . /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ $tab_icon_html . ' ' . esc_html($title) . '</button>';

echo '<div class="tab-pane fade ' . esc_attr($active) . '" id="tab-content-' . esc_attr($post_type) . '" role="tabpanel" aria-labelledby="tab-' . esc_attr($post_type) . '">';
```

**Explanation:**
The variables `$active` and `$aria_selected` were previously output without proper escaping. Both variables are constructed from conditional expressions (`$index === 0 ? 'active' : ''` and `$index === 0 ? 'true' : 'false'`) and used directly in HTML attributes. Although these specific values appear to be static strings in this context, applying `esc_attr()` to all dynamic data in attributes is a security best practice to prevent potential XSS vulnerabilities. The fix properly escapes both variables before output.

---

**Vulnerability 2:**

Vulnerability Existed: not sure

**Improper Output Escaping - CWE-79** - cube/classes/shortcodes/class-cubewp-shortcode-search.php - Line 82

**Old Code:**
```php
echo '<button ...>' . $tab_icon_html . ' ' . esc_html($title) . '</button>';
```

**Fixed Code:**
```php
echo '<button ...>' . /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ $tab_icon_html . ' ' . esc_html($title) . '</button>';
```

**Explanation:**
The `$tab_icon_html` variable is output without escaping, but a phpcs ignore comment is added rather than actually escaping the output. This suggests the developer intentionally allows unescaped HTML (likely SVG or icon markup). Without seeing where `$tab_icon_html` is defined and validated, it's uncertain whether this is a genuine vulnerability or intentional HTML output. If `$tab_icon_html` comes from user input or untrusted sources, this could be an XSS vulnerability. The phpcs comment suppresses the warning but doesn't actually fix a potential vulnerability.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php	2026-01-18 00:20:47.485236536 +0000+++ cache/cubewp-framework_1.1.28/cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php	2026-01-18 00:20:56.205778347 +0000@@ -18,180 +18,502 @@ 	{ 		if (empty($parameters) || count($parameters) == 0) 			return;+		$output_style = isset($parameters['output_style']) ? $parameters['output_style'] : 'boxed_view';+		if (strpos($output_style, '_vp_elmentor_term_') !== 0) {+			wp_enqueue_style('cwp-taxonomy-shortcode');+			$taxonomy        = isset($parameters['taxonomy']) ? $parameters['taxonomy'] : '';+			if (empty($taxonomy))+				return; -		wp_enqueue_style('cwp-taxonomy-shortcode');-		$taxonomy        = isset($parameters['taxonomy']) ? $parameters['taxonomy'] : '';-		if (empty($taxonomy))-			return;+			$terms_per_page  = $parameters['terms_per_page'];+			$_child_terms    = $parameters['child_terms'];+			$_hide_empty     = $parameters['hide_empty'];+			$icon_media_name = isset($parameters['icon_media_name']) ? $parameters['icon_media_name'] : '';+			$terms_box_color = isset($parameters['terms_box_color']) ? $parameters['terms_box_color'] : array();+			$child_terms     = false;+			$hide_empty      = false;+			if ($_child_terms == 'yes') {+				$child_terms = true;+			}+			if ($_hide_empty == 'yes') {+				$hide_empty = true;+			}+			$args  = array(+				'taxonomy'   => $taxonomy,+				'hide_empty' => $hide_empty,+				'parent'     => 0,+				'number'     => $terms_per_page,+			);+			$terms = get_terms($args); -		$terms_per_page  = $parameters['terms_per_page'];-		$output_style    = $parameters['output_style'];-		$_child_terms    = $parameters['child_terms'];-		$_hide_empty     = $parameters['hide_empty'];-		$icon_media_name = $parameters['icon_media_name'];-		$column_per_row  = $parameters['column_per_row'];-		$terms_box_color = $parameters['terms_box_color'];-		$child_terms     = false;-		$hide_empty      = false;-		$col_class       = '';-		if ($_child_terms == 'yes') {-			$child_terms = true;-		}-		if ($_hide_empty == 'yes') {-			$hide_empty = true;-		}-		if ($column_per_row == '0') {-			$col_class = 'cwp-col-12 cwp-col-md-auto';-		}-		if ($column_per_row == '1') {-			$col_class = 'cwp-col-12';-		}-		if ($column_per_row == '2') {-			$col_class = 'cwp-col-12 cwp-col-md-6';-		}-		if ($column_per_row == '3') {-			$col_class = 'cwp-col-12 cwp-col-md-6 cwp-col-lg-4';-		}-		if ($column_per_row == '4') {-			$col_class = 'cwp-col-12 cwp-col-md-6 cwp-col-lg-3';-		}-		if ($column_per_row == '6') {-			$col_class = 'cwp-col-12 cwp-col-md-6 cwp-col-lg-2';-		}-		$args  = array(-			'taxonomy'   => $taxonomy,-			'hide_empty' => $hide_empty,-			'parent'     => 0,-			'number'     => $terms_per_page,-		);-		$terms = get_terms($args);-		ob_start();-		if (! empty($terms) && is_array($terms)) {-			$counter = 0;+			// Slider functionality+			$cwp_enable_slider = isset($parameters['cwp_enable_slider']) ? $parameters['cwp_enable_slider'] : '';+			if ($cwp_enable_slider == 'yes') {+				CubeWp_Enqueue::enqueue_style('cubewp-slick');+				CubeWp_Enqueue::enqueue_script('cubewp-slick');+			}++			$slider_class = '';+			$container_attrs = '';+			if ($cwp_enable_slider == 'yes' && !empty($terms) && is_array($terms)) {+				$prev_icon = isset($parameters['prev_icon']) ? $parameters['prev_icon'] : 'fas fa-chevron-left';+				$next_icon = isset($parameters['next_icon']) ? $parameters['next_icon'] : 'fas fa-chevron-right';+				$slides_to_show = isset($parameters['slides_to_show']) ? intval($parameters['slides_to_show']) : 3;+				$slides_to_scroll = isset($parameters['slides_to_scroll']) ? intval($parameters['slides_to_scroll']) : 1;+				$slides_to_show_tablet = isset($parameters['slides_to_show_tablet']) ? intval($parameters['slides_to_show_tablet']) : 3;+				$slides_to_show_tablet_portrait = isset($parameters['slides_to_show_tablet_portrait']) ? intval($parameters['slides_to_show_tablet_portrait']) : 2;+				$slides_to_show_mobile = isset($parameters['slides_to_show_mobile']) ? intval($parameters['slides_to_show_mobile']) : 1;+				$slides_to_scroll_tablet = isset($parameters['slides_to_scroll_tablet']) ? intval($parameters['slides_to_scroll_tablet']) : 1;+				$slides_to_scroll_tablet_portrait = isset($parameters['slides_to_scroll_tablet_portrait']) ? intval($parameters['slides_to_scroll_tablet_portrait']) : 1;+				$slides_to_scroll_mobile = isset($parameters['slides_to_scroll_mobile']) ? intval($parameters['slides_to_scroll_mobile']) : 1;+				$autoplay = (isset($parameters['autoplay']) && $parameters['autoplay'] === 'yes') ? 'true' : 'false';+				$autoplay_speed = isset($parameters['autoplay_speed']) ? intval($parameters['autoplay_speed']) : 2000;+				$speed = isset($parameters['speed']) ? intval($parameters['speed']) : 500;+				$infinite = (isset($parameters['infinite']) && $parameters['infinite'] === 'yes') ? 'true' : 'false';+				$fade_effect = (isset($parameters['fade_effect']) && $parameters['fade_effect'] === 'yes') ? 'true' : 'false';+				$variable_width = (isset($parameters['variable_width']) && $parameters['variable_width'] === 'yes') ? 'true' : 'false';+				$custom_arrows = (isset($parameters['custom_arrows']) && $parameters['custom_arrows'] === 'yes') ? 'true' : 'false';+				$enable_progress_bar = (isset($parameters['enable_progress_bar']) && $parameters['enable_progress_bar'] === 'yes') ? 'true' : 'false';+				$custom_dots = (isset($parameters['custom_dots']) && $parameters['custom_dots'] === 'yes') ? 'true' : 'false';+				$enable_wrap_dots_arrows = (isset($parameters['enable_wrap_dots_arrows']) && $parameters['enable_wrap_dots_arrows'] === 'yes') ? 'true' : 'false';++				// Check if slider should be disabled based on term count+				if (wp_is_mobile() && count($terms) <= $slides_to_show_mobile) {+					$cwp_enable_slider = 'no';+				} elseif (!wp_is_mobile() && count($terms) <= $slides_to_show) {+					$cwp_enable_slider = 'no';+				}++				if ($cwp_enable_slider === 'yes') {+					$slider_class = 'cubewp-term-slider';+					$prev_icon = cubewp_get_svg_content($prev_icon);+					$next_icon = cubewp_get_svg_content($next_icon);++					// Ensure icons are strings (handle any edge cases)+					if (is_array($prev_icon)) {+						$prev_icon = isset($prev_icon['value']) ? $prev_icon['value'] : (isset($prev_icon['url']) ? $prev_icon['url'] : '');+					}+					if (is_array($next_icon)) {+						$next_icon = isset($next_icon['value']) ? $next_icon['value'] : (isset($next_icon['url']) ? $next_icon['url'] : '');+					}+					$prev_icon = is_string($prev_icon) ? $prev_icon : '';+					$next_icon = is_string($next_icon) ? $next_icon : '';++					$is_prev_svg = (is_string($prev_icon) && strpos(trim($prev_icon), '<svg') === 0);+					$is_next_svg = (is_string($next_icon) && strpos(trim($next_icon), '<svg') === 0);++					$container_attrs = '';+					if ($is_prev_svg) {+						$container_attrs .= " data-prev-arrow-svg='" . esc_attr($prev_icon) . "'";+						$container_attrs .= ' data-is-prev-svg="true"';+					} else {+						$container_attrs .= ' data-prev-arrow="' . esc_attr($prev_icon) . '"';+						$container_attrs .= ' data-is-prev-svg="false"';+					}++					if ($is_next_svg) {+						$container_attrs .= " data-next-arrow-svg='" . esc_attr($next_icon) . "'";+						$container_attrs .= ' data-is-next-svg="true"';+					} else {+						$container_attrs .= ' data-next-arrow="' . esc_attr($next_icon) . '"';+						$container_attrs .= ' data-is-next-svg="false"';+					}++					$container_attrs .= ' data-slides-to-show="' . esc_attr($slides_to_show) . '"';+					$container_attrs .= ' data-slides-to-scroll="' . esc_attr($slides_to_scroll) . '"';+					$container_attrs .= ' data-slides-to-show-tablet="' . esc_attr($slides_to_show_tablet) . '"';+					$container_attrs .= ' data-slides-show-tablet-portrait="' . esc_attr($slides_to_show_tablet_portrait) . '"';+					$container_attrs .= ' data-slides-to-show-mobile="' . esc_attr($slides_to_show_mobile) . '"';+					$container_attrs .= ' data-slides-to-scroll-tablet="' . esc_attr($slides_to_scroll_tablet) . '"';+					$container_attrs .= ' data-slides-scroll-tablet-portrait="' . esc_attr($slides_to_scroll_tablet_portrait) . '"';+					$container_attrs .= ' data-slides-to-scroll-mobile="' . esc_attr($slides_to_scroll_mobile) . '"';+					$container_attrs .= ' data-autoplay="' . esc_attr($autoplay) . '"';+					$container_attrs .= ' data-autoplay-speed="' . esc_attr($autoplay_speed) . '"';+					$container_attrs .= ' data-speed="' . esc_attr($speed) . '"';+					$container_attrs .= ' data-infinite="' . esc_attr($infinite) . '"';+					$container_attrs .= ' data-fade="' . esc_attr($fade_effect) . '"';+					$container_attrs .= ' data-variable-width="' . esc_attr($variable_width) . '"';+					$container_attrs .= ' data-custom-arrows="' . esc_attr($custom_arrows) . '"';+					$container_attrs .= ' data-custom-dots="' . esc_attr($custom_dots) . '"';+					$container_attrs .= ' data-enable-progress-bar="' . esc_attr($enable_progress_bar) . '"';+					$container_attrs .= ' data-enable-wrapper="' . esc_attr($enable_wrap_dots_arrows) . '"';+				}+			}++			ob_start();+			if (! empty($terms) && is_array($terms)) {+				$counter = 0; ?>-			<div class="cwp-row">-				<?php foreach ($terms as $term) {-					$term_id   = $term->term_id;-					$term_name = $term->name;-					if ($output_style == 'boxed_view') {-						$color_count = count($terms_box_color);-						$icon_media  = get_term_meta($term_id, $icon_media_name, true);-						$color = isset($terms_box_color[$counter]['term_box_color'])-							? sanitize_hex_color($terms_box_color[$counter]['term_box_color'])-							: '#000000';-						$counter++;-						if ($counter >= $color_count) {-							$counter = 0;-						}-				?>-						<div class="<?php echo esc_attr($col_class); ?>">-							<div class="cwp-taxonomy-term-box">-								<div class="cwp-taxonomy-term-box-heading"-									style="background-color: <?php echo esc_html($color); ?>">-									<?php-									if (! is_array($icon_media)) {-										if ($icon_media != strip_tags($icon_media)) {-											echo cubewp_core_data($icon_media);-										} else if (is_numeric($icon_media)) {-											$icon_media = wp_get_attachment_url($icon_media);-											echo '<img src="' . esc_url($icon_media) . '" alt="' . esc_attr($term_name) . '">+				<div class="cwp-taxonomy-terms <?php echo esc_attr($slider_class); ?>"<?php echo $container_attrs; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>>+					<?php foreach ($terms as $term) {+						$term_id   = $term->term_id;+						$term_name = $term->name;+						if ($output_style == 'boxed_view') {+							$color_count = !empty($terms_box_color) && is_array($terms_box_color) ? count($terms_box_color) : 0;+							$icon_media  = !empty($icon_media_name) ? get_term_meta($term_id, $icon_media_name, true) : '';+							$color = (!empty($terms_box_color) && is_array($terms_box_color) && isset($terms_box_color[$counter]['term_box_color']))+								? sanitize_hex_color($terms_box_color[$counter]['term_box_color'])+								: '#000000';+							$counter++;+							if ($color_count > 0 && $counter >= $color_count) {+								$counter = 0;+							}+					?>+							<div class="cwp-taxonomy-term">+								<div class="cwp-taxonomy-term-box">+									<div class="cwp-taxonomy-term-box-heading"+										style="background-color: <?php echo esc_html($color); ?>">+										<?php+										if (! is_array($icon_media)) {+											if ($icon_media != wp_strip_all_tags($icon_media)) {+												// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped+												echo cubewp_core_data($icon_media);+											} else if (is_numeric($icon_media)) {+												$icon_media = wp_get_attachment_url($icon_media);+												echo '<img src="' . esc_url($icon_media) . '" alt="' . esc_attr($term_name) . '"> 																		<div class="cwp-taxonomy-term-box-heading-overlay" style="background-color: ' . esc_attr($color) . ';"></div>';-										} else {-											echo '<i class="' . esc_attr($icon_media) . '" aria-hidden="true"></i>';+											} else {+												echo '<i class="' . esc_attr($icon_media) . '" aria-hidden="true"></i>';+											}+										}+										?>+										<a href="<?php echo esc_url(get_term_link($term_id)); ?>"><?php echo esc_html($term_name); ?></a>+									</div>+									<?php+									if ($child_terms) {+										$term_child_args = array(+											'taxonomy'   => $taxonomy,+											'hide_empty' => $hide_empty,+											'parent'     => $term_id,+										);+										$term_childs     = get_terms($term_child_args);+										if (! empty($term_childs) && is_array($term_childs)) {+									?>+											<ul class="cwp-taxonomy-term-child-terms">+												<?php+												$child_terms_count = count($term_childs);+												$term_counter      = 1;+												foreach ($term_childs as $term_child) {+													$child_term_id   = $term_child->term_id;+													$child_term_name = $term_child->name;+													if ($child_terms_count > 5 && 5 == $term_counter) {+												?>+														<li>+															<a href="#"+																class="cwp-taxonomy-term-child-terms-see-more"+																data-more="<?php esc_html_e("View More", "cubewp-framework"); ?>"+																data-less="<?php esc_html_e("View Less", "cubewp-framework"); ?>"><?php esc_html_e("View More", "cubewp-framework"); ?></a>+														</li>+														<ul class="cwp-taxonomy-term-child-terms-more">+														<?php+													}+														?>+														<li>+															<a href="<?php echo esc_url(get_term_link($child_term_id)); ?>"><?php echo esc_html($child_term_name); ?></a>+														</li>+														<?php+														if ($child_terms_count > 5 && $child_terms_count == $term_counter) {+														?>+														</ul>+												<?php+														}+														$term_counter++;+													}+												?>+											</ul>+									<?php 										} 									} 									?>-									<a href="<?php echo esc_url( get_term_link( $term_id ) ); ?>"><?php echo esc_html( $term_name ); ?></a> 								</div>-								<?php-								if ($child_terms) {-									$term_child_args = array(-										'taxonomy'   => $taxonomy,-										'hide_empty' => $hide_empty,-										'parent'     => $term_id,-									);-									$term_childs     = get_terms($term_child_args);-									if (! empty($term_childs) && is_array($term_childs)) {-								?>-										<ul class="cwp-taxonomy-term-child-terms">-											<?php-											$child_terms_count = count($term_childs);-											$term_counter      = 1;-											foreach ($term_childs as $term_child) {-												$child_term_id   = $term_child->term_id;-												$child_term_name = $term_child->name;-												if ($child_terms_count > 5 && 5 == $term_counter) {-											?>+							</div>+						<?php+						} else if ($output_style == 'list_view') {+						?>+							<div class="cwp-taxonomy-term">+								<div class="cwp-taxonomy-term-list">+									<a href="<?php echo esc_url(get_term_link($term_id)); ?>"><?php echo esc_html($term_name); ?></a>+									<?php+									if ($child_terms) {+										$term_child_args = array(+											'taxonomy'   => $taxonomy,+											'hide_empty' => $hide_empty,+											'parent'     => $term_id,+										);+										$term_childs     = get_terms($term_child_args);+										if (! empty($term_childs) && is_array($term_childs)) {+									?>+											<ul><?php+												foreach ($term_childs as $term_child) {+													$child_term_id   = $term_child->term_id;+													$child_term_name = $term_child->name;+												?> 													<li>-														<a href="#"-															class="cwp-taxonomy-term-child-terms-see-more"-															data-more="<?php esc_html_e("View More", "cubewp-framework"); ?>"-															data-less="<?php esc_html_e("View Less", "cubewp-framework"); ?>"><?php esc_html_e("View More", "cubewp-framework"); ?></a>+														<a href="<?php echo esc_url(get_term_link($child_term_id)); ?>"><?php echo esc_html($child_term_name); ?></a> 													</li>-													<ul class="cwp-taxonomy-term-child-terms-more">-													<?php+												<?php 												}-													?>-													<li>-														<a href="<?php echo get_term_link($child_term_id) ?>"><?php echo esc_html($child_term_name); ?></a>-													</li>-													<?php-													if ($child_terms_count > 5 && $child_terms_count == $term_counter) {-													?>-													</ul>-											<?php-													}-													$term_counter++;+												?>+											</ul><?php 												}-											?>-										</ul>-								<?php-									}-								}-								?>-							</div>-						</div>-					<?php-					} else if ($output_style == 'list_view') {-					?>-						<div class="<?php esc_attr_e($col_class); ?>">-							<div class="cwp-taxonomy-term-list">-								<a href="<?php echo get_term_link($term_id) ?>"><?php echo esc_html($term_name); ?></a>-								<?php-								if ($child_terms) {-									$term_child_args = array(-										'taxonomy'   => $taxonomy,-										'hide_empty' => $hide_empty,-										'parent'     => $term_id,-									);-									$term_childs     = get_terms($term_child_args);-									if (! empty($term_childs) && is_array($term_childs)) {-								?>-										<ul><?php-											foreach ($term_childs as $term_child) {-												$child_term_id   = $term_child->term_id;-												$child_term_name = $term_child->name;-											?>-												<li>-													<a href="<?php echo get_term_link($child_term_id) ?>"><?php echo esc_html($child_term_name); ?></a>-												</li>-											<?php-											}-											?>-										</ul><?php 											}-										}-												?>+													?>+								</div> 							</div>-						</div>-				<?php-					}-				} ?>-			</div>+					<?php+						}+					} ?>+				</div> <?php+			}++			return ob_get_clean();+		} else {+			return self::cubewp_taxonomy_get_term_card_output($parameters, $output);+		}+	}++	public static function cubewp_taxonomy_get_term_card_output($parameters, $output)+	{+		$output_style = isset($parameters['output_style']) ? $parameters['output_style'] : '';+		$template_id = 0;+		$elementor_key = str_replace('_vp_elmentor_term_', '', $output_style);+		if (ctype_digit((string) $elementor_key)) {+			$template_id = (int) $elementor_key;+		} else {+			// Otherwise treat as slug and resolve to ID+			$maybe_post = get_page_by_path($elementor_key, OBJECT, 'cubewp-tb');+			if ($maybe_post && ! is_wp_error($maybe_post)) {+				$template_id = (int) $maybe_post->ID;+			} else {+				// Fallback resolution by name query+				$by_name = get_posts(array(+					'post_type'      => 'cubewp-tb',+					'name'           => $elementor_key,+					'posts_per_page' => 1,+					'fields'         => 'ids',+				));+				if (! empty($by_name)) {+					$template_id = (int) $by_name[0];+				}+			}+		}+		if ($template_id <= 0) {+			return $output;+		}++		$taxonomy = isset($parameters['taxonomy']) ? $parameters['taxonomy'] : '';+		if (empty($taxonomy)) {+			return $output;+		}++		// Read and normalise parameters+		$terms_per_page = isset($parameters['terms_per_page']) ? $parameters['terms_per_page'] : '0';+		$child_terms    = (isset($parameters['child_terms']) && $parameters['child_terms'] === 'yes');+		$hide_empty     = (isset($parameters['hide_empty']) && $parameters['hide_empty'] === 'yes');++		$cwp_enable_slider = isset($parameters['cwp_enable_slider']) ? $parameters['cwp_enable_slider'] : '';+		if ($cwp_enable_slider) {+			CubeWp_Enqueue::enqueue_style('cubewp-slick');+			CubeWp_Enqueue::enqueue_script('cubewp-slick');+		}+		if ($cwp_enable_slider == 'yes') {+			$prev_icon = isset($parameters['prev_icon']) ? $parameters['prev_icon'] : 'fas fa-chevron-left';+			$next_icon = isset($parameters['next_icon']) ? $parameters['next_icon'] : 'fas fa-chevron-right';+			$slides_to_show = isset($parameters['slides_to_show']) ? intval($parameters['slides_to_show']) : 3;+			$slides_to_scroll = isset($parameters['slides_to_scroll']) ? intval($parameters['slides_to_scroll']) : 1;+			$slides_to_show_tablet = isset($parameters['slides_to_show_tablet']) ? intval($parameters['slides_to_show_tablet']) : 3;+			$slides_to_show_tablet_portrait = isset($parameters['slides_to_show_tablet_portrait']) ? intval($parameters['slides_to_show_tablet_portrait']) : 2;+			$slides_to_show_mobile = isset($parameters['slides_to_show_mobile']) ? intval($parameters['slides_to_show_mobile']) : 1;+			$slides_to_scroll_tablet = isset($parameters['slides_to_scroll_tablet']) ? intval($parameters['slides_to_scroll_tablet']) : 1;+			$slides_to_scroll_tablet_portrait = isset($parameters['slides_to_scroll_tablet_portrait']) ? intval($parameters['slides_to_scroll_tablet_portrait']) : 1;+			$slides_to_scroll_mobile = isset($parameters['slides_to_scroll_mobile']) ? intval($parameters['slides_to_scroll_mobile']) : 1;+			$autoplay = (isset($parameters['autoplay']) && $parameters['autoplay'] === 'yes') ? 'true' : 'false';+			$autoplay_speed = isset($parameters['autoplay_speed']) ? intval($parameters['autoplay_speed']) : 2000;+			$speed = isset($parameters['speed']) ? intval($parameters['speed']) : 500;+			$infinite = (isset($parameters['infinite']) && $parameters['infinite'] === 'yes') ? 'true' : 'false';+			$fade_effect = (isset($parameters['fade_effect']) && $parameters['fade_effect'] === 'yes') ? 'true' : 'false';+			$variable_width = (isset($parameters['variable_width']) && $parameters['variable_width'] === 'yes') ? 'true' : 'false';+			$custom_arrows = (isset($parameters['custom_arrows']) && $parameters['custom_arrows'] === 'yes') ? 'true' : 'false';+			$enable_progress_bar = (isset($parameters['enable_progress_bar']) && $parameters['enable_progress_bar'] === 'yes') ? 'true' : 'false';+			$custom_dots = (isset($parameters['custom_dots']) && $parameters['custom_dots'] === 'yes') ? 'true' : 'false';+			$enable_wrap_dots_arrows = (isset($parameters['enable_wrap_dots_arrows']) && $parameters['enable_wrap_dots_arrows'] === 'yes') ? 'true' : 'false'; 		} -		return ob_get_clean();+		// Build term query args+		$args = [+			'taxonomy'   => $taxonomy,+			'hide_empty' => $hide_empty,+		];++		// Only force parent=0 when NOT showing child terms+		if (! $child_terms) {+			$args['parent'] = 0;+		}++		// number = no limit if '0' (show all)+		if (is_numeric($terms_per_page) && (int) $terms_per_page > 0) {+			$args['number'] = (int) $terms_per_page;+		}++		$terms = get_terms($args);+		if (empty($terms) || is_wp_error($terms)) {+			return $output;+		}+		if ($cwp_enable_slider === 'yes') {+			if (wp_is_mobile() && count($terms) <= $slides_to_show_mobile) {+				$cwp_enable_slider = 'no';+			} elseif (!wp_is_mobile() && count($terms) <= $slides_to_show) {+				$cwp_enable_slider = 'no';+			}+		}+		$slider_class = $cwp_enable_slider === 'yes' ? 'cubewp-term-slider' : '';+		$container_open = '<div class="cwp-taxonomy-terms cwp-elementor-taxonomy-terms ' . esc_attr($slider_class) . '"';+		if ($cwp_enable_slider) {+			$prev_icon = cubewp_get_svg_content($prev_icon);+			$next_icon = cubewp_get_svg_content($next_icon);++			// Ensure icons are strings (handle any edge cases - should not be needed after fix, but safety check)+			if (is_array($prev_icon)) {+				$prev_icon = isset($prev_icon['value']) ? $prev_icon['value'] : (isset($prev_icon['url']) ? $prev_icon['url'] : '');+			}+			if (is_array($next_icon)) {+				$next_icon = isset($next_icon['value']) ? $next_icon['value'] : (isset($next_icon['url']) ? $next_icon['url'] : '');+			}+			$prev_icon = is_string($prev_icon) ? $prev_icon : '';+			$next_icon = is_string($next_icon) ? $next_icon : '';++			$is_prev_svg = (is_string($prev_icon) && strpos(trim($prev_icon), '<svg') === 0);+			$is_next_svg = (is_string($next_icon) && strpos(trim($next_icon), '<svg') === 0);++			if ($is_prev_svg) {+				$container_open .= " data-prev-arrow-svg='" . esc_attr($prev_icon) . "'";+				$container_open .= ' data-is-prev-svg="true"';+			} else {+				$container_open .= ' data-prev-arrow="' . esc_attr($prev_icon) . '"';+				$container_open .= ' data-is-prev-svg="false"';+			}++			if ($is_next_svg) {+				$container_open .= " data-next-arrow-svg='" . esc_attr($next_icon) . "'";+				$container_open .= ' data-is-next-svg="true"';+			} else {+				$container_open .= ' data-next-arrow="' . esc_attr($next_icon) . '"';+				$container_open .= ' data-is-next-svg="false"';+			}++			$container_open .= ' data-slides-to-show="' . esc_attr($slides_to_show) . '"';+			$container_open .= ' data-slides-to-scroll="' . esc_attr($slides_to_scroll) . '"';+			$container_open .= ' data-slides-to-show-tablet="' . esc_attr($slides_to_show_tablet) . '"';+			$container_open .= ' data-slides-show-tablet-portrait="' . esc_attr($slides_to_show_tablet_portrait) . '"';+			$container_open .= ' data-slides-to-show-mobile="' . esc_attr($slides_to_show_mobile) . '"';+			$container_open .= ' data-slides-to-scroll-tablet="' . esc_attr($slides_to_scroll_tablet) . '"';+			$container_open .= ' data-slides-scroll-tablet-portrait="' . esc_attr($slides_to_scroll_tablet_portrait) . '"';+			$container_open .= ' data-slides-to-scroll-mobile="' . esc_attr($slides_to_scroll_mobile) . '"';+			$container_open .= ' data-autoplay="' . esc_attr($autoplay) . '"';+			$container_open .= ' data-autoplay-speed="' . esc_attr($autoplay_speed) . '"';+			$container_open .= ' data-speed="' . esc_attr($speed) . '"';+			$container_open .= ' data-infinite="' . esc_attr($infinite) . '"';+			$container_open .= ' data-fade="' . esc_attr($fade_effect) . '"';+			$container_open .= ' data-variable-width="' . esc_attr($variable_width) . '"';+			$container_open .= ' data-custom-arrows="' . esc_attr($custom_arrows) . '"';+			$container_open .= ' data-custom-dots="' . esc_attr($custom_dots) . '"';+			$container_open .= ' data-enable-progress-bar="' . esc_attr($enable_progress_bar) . '"';+			$container_open .= ' data-enable-wrapper="' . esc_attr($enable_wrap_dots_arrows) . '"';+		}+		$container_open .= '>';+		$container_close = '</div>';+		$terms_output = '';+		$terms_output .= $container_open;++		static $processed_templates = [];+		$term_settings  = isset($parameters['term_grid_settings']) ? $parameters['term_grid_settings'] : array(); +		$addClass = '';+		$matchedIndex = null;+		$dynamic_css = "";+		$termCount  = 1;+		foreach ($terms as $term) :+			global $cubewp_term;+			$cubewp_term = $term;+			foreach ($term_settings as $index => $item) {+				if (isset($item['term_position']) && $item['term_position'] == $termCount) {+					$matchedIndex = $index;+					break;+				}+			}+			if ($matchedIndex !== null) {+				$unique_class = 'cwp-term-' . $termCount . '-' . wp_generate_password(4, false, false);+				$margin = isset($term_settings[$matchedIndex]['custom_margin']['top']) ? $term_settings[$matchedIndex]['custom_margin']['top'] . $term_settings[$matchedIndex]['custom_margin']['unit'] . ' ' . $term_settings[$matchedIndex]['custom_margin']['right'] . $term_settings[$matchedIndex]['custom_margin']['unit'] . ' ' . $term_settings[$matchedIndex]['custom_margin']['bottom'] . $term_settings[$matchedIndex]['custom_margin']['unit'] . ' ' . $term_settings[$matchedIndex]['custom_margin']['left'] . $term_settings[$matchedIndex]['custom_margin']['unit'] : '';+				$padding = isset($term_settings[$matchedIndex]['custom_padding']['top']) ? $term_settings[$matchedIndex]['custom_padding']['top'] . $term_settings[$matchedIndex]['custom_padding']['unit'] . ' ' . $term_settings[$matchedIndex]['custom_padding']['right'] . $term_settings[$matchedIndex]['custom_padding']['unit'] . ' ' . $term_settings[$matchedIndex]['custom_padding']['bottom'] . $term_settings[$matchedIndex]['custom_padding']['unit'] . ' ' . $term_settings[$matchedIndex]['custom_padding']['left'] . $term_settings[$matchedIndex]['custom_padding']['unit'] : '';+				$css_rules = "";+				/* COLUMN SPAN */+				if (!empty($term_settings[$matchedIndex]['column_span'])) {+					$col = $term_settings[$matchedIndex]['column_span'];+					$css_rules .= "grid-column: span {$col} / span {$col};";+				}+				/* ROW SPAN */+				if (!empty($term_settings[$matchedIndex]['row_span'])) {+					$row = $term_settings[$matchedIndex]['row_span'];+					$css_rules .= "grid-row: span {$row} / span {$row};";+				}+				/* MARGIN */+				if (!empty($margin)) {+					$css_rules .= "margin: {$margin};";+				}+				/* PADDING */+				if (!empty($padding)) {+					$css_rules .= "padding: {$padding};";+				}+				/* WIDTH */+				if (!empty($term_settings[$matchedIndex]['custom_width']['size'])) {+					$size = $term_settings[$matchedIndex]['custom_width']['size'];+					$unit = $term_settings[$matchedIndex]['custom_width']['unit'] ?? 'px';+					$css_rules .= "width: {$size}{$unit};";+				}+				/* HEIGHT */+				if (!empty($term_settings[$matchedIndex]['custom_height']['size'])) {+					$size = $term_settings[$matchedIndex]['custom_height']['size'];+					$unit = $term_settings[$matchedIndex]['custom_height']['unit'] ?? 'px';+					$css_rules .= "height: {$size}{$unit};";+				}+				/* GRID COLUMN START */+				if (!empty($term_settings[$matchedIndex]['column_span_start'])) {+					$css_rules .= "grid-column-start: {$term_settings[$matchedIndex]['column_span_start']};";+				}+				/* GRID ROW START */+				if (!empty($term_settings[$matchedIndex]['row_span_start'])) {+					$css_rules .= "grid-row-start: {$term_settings[$matchedIndex]['row_span_start']};";+				}+				if (!empty($css_rules)) {+					$dynamic_css .= ".cwp-taxonomy-term-{$unique_class} { {$css_rules} } ";+				}+				$terms_output .= '<div class="cwp-taxonomy-term cwp-elementor-term-card cwp-taxonomy-term-' . $unique_class . '">';+			} else {+				$terms_output .= '<div class="cwp-taxonomy-term cwp-elementor-term-card ">';+			}+			if (!in_array($template_id, $processed_templates, true)) {+				ob_start();+				echo CubeWp_Theme_Builder::do_cubewp_theme_builder('termcard', $template_id); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Theme builder content is safe.+				$terms_output .= ob_get_clean();+				$processed_templates[] = $template_id;+			} else {+				ob_start();+				echo cwp_get_elementor_content_without_styles($template_id); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Elementor content is safe.+				$terms_output .= ob_get_clean();+			}+			$terms_output .= '</div>';+			unset($GLOBALS['cubewp_term']);+			$termCount++;+		endforeach;+		$terms_output .= $container_close;+		if (!empty($dynamic_css)) {+			// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped+			echo "<style>+			@media (min-width: 1024px) {+				" . $dynamic_css . "+			} </style>";+		}+		return $terms_output; 	}  	public static function init()

Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Input During Web Page Generation (CWE-79 - Cross-Site Scripting) - class-cubewp-shortcode-taxonomy.php Lines 88-90
Old Code:
```php
$container_attrs = '';
if ($is_prev_svg) {
    $container_attrs .= " data-prev-arrow-svg='" . esc_attr($prev_icon) . "'";
```

Fixed Code:
```php
$container_attrs = '';
if ($is_prev_svg) {
    $container_attrs .= " data-prev-arrow-svg='" . esc_attr($prev_icon) . "'";
```

Explanation:
While the fixed code uses `esc_attr()` on the SVG content, the vulnerability exists because SVG data containing quotes or other characters could break out of the attribute context. The code attempts to concatenate escaped SVG content into a data attribute using single quotes, but if the SVG contains single quotes, it could break the attribute boundary. However, upon closer inspection, `esc_attr()` should escape single quotes as `'`, so the actual vulnerability risk is mitigated by the escaping function used. The code appears secure with proper use of `esc_attr()`.

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Input During Web Page Generation (CWE-79 - Cross-Site Scripting) - class-cubewp-shortcode-taxonomy.php Lines 113-114
Old Code:
```php
<?php foreach ($terms as $term) {
    $term_id   = $term->term_id;
    $term_name = $term->name;
    if ($output_style == 'boxed_view') {
        ...
        if ($icon_media != strip_tags($icon_media)) {
            echo cubewp_core_data($icon_media);
```

Fixed Code:
```php
<?php foreach ($terms as $term) {
    $term_id   = $term->term_id;
    $term_name = $term->name;
    if ($output_style == 'boxed_view') {
        ...
        if ($icon_media != wp_strip_all_tags($icon_media)) {
            // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
            echo cubewp_core_data($icon_media);
```

Explanation:
The code changed from `strip_tags()` to `wp_strip_all_tags()`, which is the proper WordPress function. The echoing of `cubewp_core_data($icon_media)` output is still unescaped, but this is intentional as indicated by the phpcs comment. The vulnerability would exist if `cubewp_core_data()` doesn't properly sanitize its output, but the fix shows awareness of the issue with the explicit phpcs ignore comment.

---

Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Input During Web Page Generation (CWE-79 - Cross-Site Scripting) - class-cubewp-shortcode-taxonomy.php Line 59
Old Code:
```php
<?php echo $container_attrs; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
```

Fixed Code:
```php
<?php echo $container_attrs; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
```

Explanation:
The `$container_attrs` variable is output without escaping using a phpcs ignore comment. While the variable is built using `esc_attr()` calls throughout, concatenating pre-escaped attributes and outputting them directly could be problematic if any code path doesn't properly escape. This is intentional but represents a potential XSS vector if `cubewp_get_svg_content()` returns unescaped SVG markup that gets concatenated into attributes.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-business-hours-field.php	2026-01-18 00:20:47.489236784 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-business-hours-field.php	2026-01-18 00:20:56.205778347 +0000@@ -113,30 +113,30 @@         $args['type'] = 'dropdown';         $args['name'] = $args['custom_name'] = $field_name . '_day';         $args['id'] = $field_id . '_day';-        $args['placeholder'] = esc_html__('Select Day', 'cubewp-yellow-books');+        $args['placeholder'] = esc_html__('Select Day', 'cubewp-framework');         $args['class'] = 'business-days';         $output .= self::yellow_books_render_dropdown_admin($args);          $args['name'] = $args['custom_name'] = $field_name . '_open_time';         $args['id'] = $field_id . '_open_time';         $args['type'] = 'time_picker';-        $args['placeholder'] = esc_html__('Open Time', 'cubewp-yellow-books');+        $args['placeholder'] = esc_html__('Open Time', 'cubewp-framework');         $args['class'] = 'business-open-time';         $output .= self::yellow_books_render_timepicker_admin($args);          $args['name'] = $args['custom_name'] = $field_name . '_close_time';         $args['id'] = $field_id . '_close_time';-        $args['placeholder'] = esc_html__('Close Time', 'cubewp-yellow-books');+        $args['placeholder'] = esc_html__('Close Time', 'cubewp-framework');         $args['admin_size'] = '1/3';         $args['class'] = 'business-close-time';         $output .= self::yellow_books_render_timepicker_admin($args);          $output .= '<div class="yb_business_hour_fulldayopen">                         <input type="checkbox" id="yb_fulldayopen" class="yb_fulldayopen">-                        <label>' . esc_html__('24 Hours', 'cubewp-yellow-books') . '</label>+                        <label>' . esc_html__('24 Hours', 'cubewp-framework') . '</label>                     </div>';         $output .= '</div>';-        $output .= '<button class="cwp-add-new-business-hour" data-id="' . $field_id . '" data-name="' . $field_name . '"  data-fullday="' . __('24 hours open', 'cubewp-yellow-books') . '">+        $output .= '<button class="cwp-add-new-business-hour" data-id="' . $field_id . '" data-name="' . $field_name . '"  data-fullday="' . __('24 hours open', 'cubewp-framework') . '">                         <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">                             <path fill-rule="evenodd" d="M8 2a.5.5 0 0 1 .5.5v5h5a.5.5 0 0 1 0 1h-5v5a.5.5 0 0 1-1 0v-5h-5a.5.5 0 0 1 0-1h5v-5A.5.5 0 0 1 8 2Z"/>                         </svg>

Vulnerability Existed: no

No Security Vulnerability - cubewp-admin-business-hours-field.php (Lines 116, 122, 128, 137, 141)

Old Code:
```php
$args['placeholder'] = esc_html__('Select Day', 'cubewp-yellow-books');
$args['placeholder'] = esc_html__('Open Time', 'cubewp-yellow-books');
$args['placeholder'] = esc_html__('Close Time', 'cubewp-yellow-books');
<label>' . esc_html__('24 Hours', 'cubewp-yellow-books') . '</label>
data-fullday="' . __('24 hours open', 'cubewp-yellow-books') . '"
```

Fixed Code:
```php
$args['placeholder'] = esc_html__('Select Day', 'cubewp-framework');
$args['placeholder'] = esc_html__('Open Time', 'cubewp-framework');
$args['placeholder'] = esc_html__('Close Time', 'cubewp-framework');
<label>' . esc_html__('24 Hours', 'cubewp-framework') . '</label>
data-fullday="' . __('24 hours open', 'cubewp-framework') . '"
```

Explanation:
This diff contains only textdomain string updates, changing references from `'cubewp-yellow-books'` to `'cubewp-framework'`. The textdomain parameter in WordPress translation functions (`esc_html__()` and `__()`) is used for i18n/l10n purposes and does not introduce, fix, or relate to any security vulnerabilities. The actual content strings ('Select Day', 'Open Time', etc.) remain unchanged and are already properly escaped with `esc_html__()` for safe output. This is a localization refactoring with no security impact.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-date-picker-field.php	2026-01-18 00:20:47.489236784 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-date-picker-field.php	2026-01-18 00:20:56.205778347 +0000@@ -35,8 +35,8 @@          $args   =  apply_filters( 'cubewp/admin/field/parametrs', $args );         -        if($args['value'] != '' && is_numeric($args['value'])){-            $args['value'] = date(get_option('date_format'), $args['value']);+        if ( ! empty( $args['value'] ) && is_numeric( $args['value'] ) ) {+            $args['value'] = wp_date( get_option( 'date_format' ), (int) $args['value'] );         }                  $output = $this->cwp_field_wrap_start($args);

# Security Analysis

**Vulnerability Existed: yes**
FALSE POSITIVE

**Cross-Site Scripting (XSS) / Improper Output Encoding - CWE-79 - cube/fields/admin/cubewp-admin-date-picker-field.php - Lines 38-39**

**Old Code:**
```php
if($args['value'] != '' && is_numeric($args['value'])){
    $args['value'] = date(get_option('date_format'), $args['value']);
}
```

**Fixed Code:**
```php
if ( ! empty( $args['value'] ) && is_numeric( $args['value'] ) ) {
    $args['value'] = wp_date( get_option( 'date_format' ), (int) $args['value'] );
}
```

**Explanation:**

The vulnerability existed due to the use of PHP's native `date()` function instead of WordPress's `wp_date()` function. The `wp_date()` function is WordPress's recommended approach for date formatting and includes proper timezone handling and escaping considerations specific to WordPress environments.

Additionally, the fix includes explicit type casting `(int) $args['value']` which ensures the timestamp is properly validated as an integer before being passed to the date function, preventing potential type juggling vulnerabilities. The use of `! empty()` instead of `!= ''` is also a more robust check that aligns with WordPress coding standards.

The primary security improvement is switching from the native PHP `date()` function to `wp_date()`, which ensures proper WordPress sanitization and localization standards are applied to the date output, reducing XSS and data integrity risks in an admin context.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-date-time-picker-field.php	2026-01-18 00:20:47.489236784 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-date-time-picker-field.php	2026-01-18 00:20:56.205778347 +0000@@ -34,8 +34,8 @@         wp_enqueue_style('cubewp-datepicker');         $args   =  apply_filters( 'cubewp/admin/field/parametrs', $args );         -        if($args['value'] != '' && is_numeric($args['value'])){-            $args['value'] = date(get_option('date_format') .' '. get_option('time_format'), $args['value']);+if ( ! empty( $args['value'] ) && is_numeric( $args['value'] ) ) {+            $args['value'] = wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $args['value'] );         }                  $output = $this->cwp_field_wrap_start($args);

Vulnerability Existed: yes
TRUE POSITIVE
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - cube/fields/admin/cubewp-admin-date-time-picker-field.php Lines 37-38
[Old Code]
if($args['value'] != '' && is_numeric($args['value'])){
    $args['value'] = date(get_option('date_format') .' '. get_option('time_format'), $args['value']);
}

[Fixed Code]
if ( ! empty( $args['value'] ) && is_numeric( $args['value'] ) ) {
    $args['value'] = wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $args['value'] );
}

Explanation:
The old code used PHP's native `date()` function which does not apply WordPress security sanitization and escaping. The fix addresses this by:
1. Replacing `date()` with `wp_date()` - WordPress's secure wrapper function that applies proper sanitization
2. Casting the value to `(int)` to ensure type safety and prevent potential injection
3. Using `! empty()` instead of `!= ''` which is more robust for checking non-empty values
4. Improving code formatting/spacing for WordPress coding standards

The vulnerability existed because user-controlled `$args['value']` could be formatted and output without proper escaping, potentially leading to XSS if the value or date format options contained malicious content.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-file-field.php	2026-01-18 00:20:47.493237033 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-file-field.php	2026-01-18 00:20:56.205778347 +0000@@ -51,6 +51,7 @@         }else {             $accept = esc_html__("PDF, zip, txt, word and other file types", 'cubewp-framework');         }+        /* translators: %s: allowed file types. */         $attr   .= 'placeholder="'.sprintf(esc_html__("Allowed only: '%s'.", 'cubewp-framework'), $accept).'"'; 		$output .= '<div class="cwp-custom-field cwp-upload-field">             <div class="cwp-field">

Vulnerability Existed: no
No Security Vulnerabilities Detected - File: cube/fields/admin/cubewp-admin-file-field.php [Lines 51-55]

Old Code:
```
$attr   .= 'placeholder="'.sprintf(esc_html__("Allowed only: '%s'.", 'cubewp-framework'), $accept).'"';
```

Fixed Code:
```
/* translators: %s: allowed file types. */
$attr   .= 'placeholder="'.sprintf(esc_html__("Allowed only: '%s'.", 'cubewp-framework'), $accept).'"';
```

Explanation:
This change is a documentation improvement, not a security fix. The added comment `/* translators: %s: allowed file types. */` is a translator comment that helps localization teams understand the purpose of the `%s` placeholder in the translatable string. The underlying code remains unchanged and continues to properly escape output using `esc_html__()`, which prevents HTML/script injection. No vulnerability existed before, and none is introduced by this change.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-image-field.php	2026-01-18 00:20:47.493237033 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-image-field.php	2026-01-18 00:20:56.205778347 +0000@@ -53,6 +53,7 @@         }else {             $accept = esc_html__("image/png, image/jpg, image/jpeg, image/gif", 'cubewp-framework');         }+        /* translators: %s: allowed file types. */         $attr   .= 'placeholder="'.sprintf(esc_html__("Allowed only: '%s'.", 'cubewp-framework'), $accept).'"'; 		$output .= '<div class="cwp-custom-field cwp-upload-field">             <div class="cwp-field">

Vulnerability Existed: no

Cross-Site Scripting (XSS) - CWE-79 - cube/fields/admin/cubewp-admin-image-field.php Lines 56

Old Code:
```php
$attr   .= 'placeholder="'.sprintf(esc_html__("Allowed only: '%s'.", 'cubewp-framework'), $accept).'"';
```

Fixed Code:
```php
/* translators: %s: allowed file types. */
$attr   .= 'placeholder="'.sprintf(esc_html__("Allowed only: '%s'.", 'cubewp-framework'), $accept).'"';
```

Explanation:
No vulnerability was introduced or fixed by this change. The diff only adds a translator comment (`/* translators: %s: allowed file types. */`) above the existing code line. The actual code logic remains identical. The original code was already properly escaped using `esc_html__()` for the translatable string, and the `$accept` variable is derived from either a hardcoded string or `sanitize_text_field()`, both of which are safe. The added comment is a best practice for translators to understand placeholder variables and does not affect security. The code does not introduce or fix any XSS vulnerability.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-repeater-field.php	2026-01-18 00:20:47.493237033 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-repeater-field.php	2026-01-18 00:20:56.205778347 +0000@@ -47,7 +47,7 @@ 					foreach ($args['sub_fields'] as $sub_field) { 						$sub_field['custom_name'] = 'cwp_meta[' . $args['name'] . '][' . $sub_field['name'] . '][]'; 						$sub_field['value']       = isset($args['value'][$i][$sub_field['name']]) ? $args['value'][$i][$sub_field['name']] : '';-						$sub_field['id']          = 'cwp_' . rand(123456789, 1111111111);+						$sub_field['id']          = 'cwp_' . wp_rand(123456789, 1111111111); 						$sub_field['wrap']        = true; 						if ($sub_field['type'] == 'google_address') { 							$sub_field['custom_name_lat'] = 'cwp_meta[' . $args['name'] . '][' . $sub_field['name'] . '_lat' . '][]';@@ -93,11 +93,11 @@ 	 * @since  1.0.0 	 */ 	public function cwp_add_repeating_field() {-		if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce') ) {+		if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce') ) {             wp_send_json( array( 'success' => 'false', 'msg' => esc_html__('Invalid nonce. You are not authorized to perform this action.', 'cubewp-framework') ) );             wp_die();         }-		$field_id      = isset($_POST['id']) ? sanitize_text_field($_POST['id']) : '';+		$field_id      = isset($_POST['id']) ? sanitize_text_field(wp_unslash($_POST['id'])) : ''; 		$field_options = get_field_options($field_id); 		$field_of      = 'post'; 		if (empty($field_options) && count($field_options) == 0) {@@ -124,7 +124,7 @@ 				$sub_field_options['custom_name'] = 'cwp_meta[' . $field_options['name'] . '][' . $sub_field_options['name'] . '][]'; 				$sub_field_options['value']       = isset($sub_field_options['default_value']) ? $sub_field_options['default_value'] : ''; -				$sub_field_options['id']   = 'cwp_' . rand(123456789, 1111111111);+				$sub_field_options['id']   = 'cwp_' . wp_rand(123456789, 1111111111); 				$sub_field_options['wrap'] = true; 				if ($sub_field_options['type'] == 'google_address') { 					$sub_field_options['custom_name_lat'] = 'cwp_meta[' . $field_options['name'] . '][' . $sub_field_options['name'] . '_lat' . '][]';

I'll analyze this code diff for security vulnerabilities.

---

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE

Cryptographically Weak Pseudo-Random Number Generator (PRNG) - CWE-338 - cube/fields/admin/cubewp-admin-repeater-field.php - Lines 50, 127

Old Code:
```php
$sub_field['id'] = 'cwp_' . rand(123456789, 1111111111);
```

Fixed Code:
```php
$sub_field['id'] = 'cwp_' . wp_rand(123456789, 1111111111);
```

Explanation:
The `rand()` function in PHP uses a weak PRNG that is predictable and unsuitable for security-sensitive operations. While in this context the ID is used for HTML element identification (not cryptographic purposes), using `rand()` creates predictable IDs that could be exploited for attacks like CSRF or session fixation if these IDs are later used in security contexts. WordPress provides `wp_rand()` which is a more secure alternative that uses `random_bytes()` when available or `mt_rand()` as a fallback, making it significantly harder to predict. This change applies to both line 50 and line 127.

---

**Vulnerability 2:**

Vulnerability Existed: yes
FALSE POSITIVE

Improper Input Validation - CWE-20 - cube/fields/admin/cubewp-admin-repeater-field.php - Line 96

Old Code:
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cubewp-admin-nonce') ) {
```

Fixed Code:
```php
if ( !isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'cubewp-admin-nonce') ) {
```

Explanation:
The `$_POST['nonce']` value was passed directly to `wp_verify_nonce()` without sanitization. While `wp_verify_nonce()` internally performs some validation, best practice in WordPress is to sanitize all user input before use. The fix wraps the nonce with `wp_unslash()` (to remove magic quotes if present) and `sanitize_text_field()` (to remove potentially harmful characters). This prevents potential injection attacks and ensures the nonce is properly cleaned before verification.

---

**Vulnerability 3:**

Vulnerability Existed: yes
FALSE POSITIVE

Improper Input Validation - CWE-20 - cube/fields/admin/cubewp-admin-repeater-field.php - Line 100

Old Code:
```php
$field_id = isset($_POST['id']) ? sanitize_text_field($_POST['id']) : '';
```

Fixed Code:
```php
$field_id = isset($_POST['id']) ? sanitize_text_field(wp_unslash($_POST['id'])) : '';
```

Explanation:
The `$_POST['id']` value had `sanitize_text_field()` applied, but was missing `wp_unslash()` beforehand. The `wp_unslash()` function removes magic quotes that may have been automatically added by PHP/WordPress. Without it, escaped quotes could persist in the sanitized value, leading to incorrect data processing or potential injection vectors if the data is later used in SQL queries or other contexts. The fix ensures proper handling of all potential escape sequences.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-taxonomy-field.php	2026-01-18 00:20:47.493237033 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-taxonomy-field.php	2026-01-18 00:20:56.205778347 +0000@@ -87,7 +87,8 @@ 			}  			if ($taxonomy->name == 'category' || $taxonomy->name == 'post_tag' || $taxonomy->name == 'post_format') {-				$taxonomy_label = sprintf(__('%s (WP Core)'), $taxonomy->label);+				/* translators: %s: taxonomy label. */+				$taxonomy_label = sprintf(__( '%s (WP Core)', 'cubewp-framework' ), $taxonomy->label); 			} else { 				$taxonomy_label = $taxonomy->label; 			}

Vulnerability Existed: no
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - CWE-89 - cube/fields/admin/cubewp-admin-taxonomy-field.php [90]

Old Code:
```php
$taxonomy_label = sprintf(__('%s (WP Core)'), $taxonomy->label);
```

Fixed Code:
```php
/* translators: %s: taxonomy label. */
$taxonomy_label = sprintf(__( '%s (WP Core)', 'cubewp-framework' ), $taxonomy->label);
```

Explanation:
This is not a security vulnerability fix. The change improves WordPress internationalization (i18n) best practices by adding the text domain parameter `'cubewp-framework'` to the `__()` function and adding a translator comment. This ensures proper localization of the string in the CubeWP framework. The `sprintf()` function with `$taxonomy->label` does not introduce SQL injection risk since this is a display string, not a database query. The `$taxonomy->label` is a WordPress taxonomy object property and is safely used for display purposes. The original code was functionally correct but lacked proper i18n domain specification, which this fix addresses.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-time-picker-field.php	2026-01-18 00:20:47.497237281 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/admin/cubewp-admin-time-picker-field.php	2026-01-18 00:20:56.205778347 +0000@@ -36,7 +36,7 @@         $args   =  apply_filters( 'cubewp/admin/field/parametrs', $args );                  if($args['value'] != '' && is_numeric($args['value'])){-            $args['value'] = date(get_option('time_format'), $args['value']);+            $args['value'] = wp_date(get_option('time_format'), $args['value']);         }                  $output = $this->cwp_field_wrap_start($args);

# Security Analysis Report

Vulnerability Existed: **yes**

**Cross-Site Scripting (XSS) / Improper Output Encoding - CWE-79** - cubewp-framework_1.1.27/cube/fields/admin/cubewp-admin-time-picker-field.php - Line 39

**Old Code:**
```php
$args['value'] = date(get_option('time_format'), $args['value']);
```

**Fixed Code:**
```php
$args['value'] = wp_date(get_option('time_format'), $args['value']);
```

**Explanation:**

The vulnerability was **Timezone Handling / Data Integrity Issue** rather than a direct XSS, but the fix addresses a security-relevant concern:

1. **Original Issue**: The `date()` function uses PHP's default timezone, which may not match WordPress's configured timezone setting. This can cause:
   - Incorrect time display for users in different timezones
   - Potential security issues in time-dependent operations (token expiration, scheduling, etc.)

2. **Why This Matters**: If the application relies on time values for security decisions (e.g., session timeouts, rate limiting, token expiration), timezone mismatches could be exploited to bypass these controls.

3. **The Fix**: `wp_date()` is WordPress's timezone-aware wrapper around PHP's `date()` function that:
   - Respects the WordPress site's configured timezone (`WP_TIMEZONE` or blog timezone option)
   - Ensures consistent time formatting across the application
   - Prevents timezone-based security bypasses

4. **Security Impact**: This is a **defensive fix** that prevents potential timezone-based vulnerabilities and ensures the application behaves predictably across different server configurations and user timezones.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-business-hours-field.php	2026-01-18 00:20:47.497237281 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-business-hours-field.php	2026-01-18 00:20:56.205778347 +0000@@ -109,7 +109,7 @@         $args['id'] = $field_id . '_day';         $args['custom_name'] = $field_name . '_day';         $args['label'] = '';-        $args['placeholder'] = esc_html__('Select Day', 'cubewp-yellow-books');+        $args['placeholder'] = esc_html__('Select Day', 'cubewp-framework');         $args['field_size'] = 'size-1-3';         $args['class'] = 'business-days';         $output .= apply_filters("cubewp/frontend/dropdown/field", $output, $args);@@ -118,7 +118,7 @@         $args['custom_name'] = $field_name . '_open_time';         $args['type'] = 'time_picker';         $args['label'] = '';-        $args['placeholder'] = esc_html__('Open Time', 'cubewp-yellow-books');+        $args['placeholder'] = esc_html__('Open Time', 'cubewp-framework');         $args['field_size'] = 'size-1-3';         $args['class'] = 'business-open-time';         $output .= apply_filters("cubewp/frontend/time_picker/field", $output, $args);@@ -126,16 +126,16 @@         $args['id'] = $field_id . '_close_time';         $args['custom_name'] = $field_name . '_close_time';         $args['label'] = '';-        $args['placeholder'] = esc_html__('Close Time', 'cubewp-yellow-books');+        $args['placeholder'] = esc_html__('Close Time', 'cubewp-framework');         $args['field_size'] = 'size-1-3';         $args['class'] = 'business-close-time';         $output .= apply_filters("cubewp/frontend/time_picker/field", $output, $args);         $output .= '<div class="yb_business_hour_fulldayopen">                         <input type="checkbox" id="yb_fulldayopen" class="yb_fulldayopen">-                        <label>' . esc_html__('24 Hours', 'cubewp-yellow-books') . '</label>+                        <label>' . esc_html__('24 Hours', 'cubewp-framework') . '</label>                     </div>';         $output .= '</div>';-        $output .= '<button class="cwp-add-new-business-hour" data-id="' . $field_id . '" data-name="' . $field_name . '"  data-fullday="' . __('24 hours open', 'cubewp-yellow-books') . '">+        $output .= '<button class="cwp-add-new-business-hour" data-id="' . $field_id . '" data-name="' . $field_name . '"  data-fullday="' . __('24 hours open', 'cubewp-framework') . '">                         <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">                             <path fill-rule="evenodd" d="M8 2a.5.5 0 0 1 .5.5v5h5a.5.5 0 0 1 0 1h-5v5a.5.5 0 0 1-1 0v-5h-5a.5.5 0 0 1 0-1h5v-5A.5.5 0 0 1 8 2Z"/>                         </svg>

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: no

[Text Domain Inconsistency - Not a Security Vulnerability] - [N/A] - [cube/fields/frontend/cubewp-frontend-business-hours-field.php] [Lines 112, 121, 129, 135, 139]

Old Code:
```php
$args['placeholder'] = esc_html__('Select Day', 'cubewp-yellow-books');
$args['placeholder'] = esc_html__('Open Time', 'cubewp-yellow-books');
$args['placeholder'] = esc_html__('Close Time', 'cubewp-yellow-books');
<label>' . esc_html__('24 Hours', 'cubewp-yellow-books') . '</label>
data-fullday="' . __('24 hours open', 'cubewp-yellow-books') . '"
```

Fixed Code:
```php
$args['placeholder'] = esc_html__('Select Day', 'cubewp-framework');
$args['placeholder'] = esc_html__('Open Time', 'cubewp-framework');
$args['placeholder'] = esc_html__('Close Time', 'cubewp-framework');
<label>' . esc_html__('24 Hours', 'cubewp-framework') . '</label>
data-fullday="' . __('24 hours open', 'cubewp-framework') . '"
```

Explanation:
This diff changes the text domain from 'cubewp-yellow-books' to 'cubewp-framework' in multiple string localization calls. This is **not a security vulnerability**. The changes maintain the same output escaping mechanisms (`esc_html__()` and `__()`) and only update the text domain identifier used by WordPress for translation lookups. The security functions remain intact and properly escape all user-facing output. This is a maintenance change to align text domains across the codebase.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-date-picker-field.php	2026-01-18 00:20:47.497237281 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-date-picker-field.php	2026-01-18 00:20:56.205778347 +0000@@ -45,7 +45,7 @@         $output         = self::cwp_frontend_post_field_container($args);          if($args['value'] != '' && is_numeric($args['value'])){-            $args['value'] = date(get_option('date_format'), $args['value']);+            $args['value'] = wp_date(get_option('date_format'), $args['value']);         }             $output .= self::cwp_frontend_field_label($args);             $input_attrs = array( 

Vulnerability Existed: no

[Insecure Date/Time Handling] - [CWE-345] - [cube/fields/frontend/cubewp-frontend-date-picker-field.php] [Line 48]

Old Code:
```php
$args['value'] = date(get_option('date_format'), $args['value']);
```

Fixed Code:
```php
$args['value'] = wp_date(get_option('date_format'), $args['value']);
```

Explanation:
This change replaces PHP's native `date()` function with WordPress's `wp_date()` function. While the native `date()` function itself is not inherently vulnerable to security attacks, this change improves timezone handling and WordPress compatibility. The `wp_date()` function respects the WordPress timezone settings configured in the admin panel, whereas `date()` uses PHP's default timezone. This is a security/correctness improvement rather than a fix for an actual vulnerability, as it prevents potential timezone-related data inconsistencies that could lead to incorrect date representation. The vulnerability did not exist in the traditional sense, but the code has been improved to follow WordPress best practices and avoid potential timezone-related issues.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-date-time-picker-field.php	2026-01-18 00:20:47.497237281 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-date-time-picker-field.php	2026-01-18 00:20:56.205778347 +0000@@ -44,7 +44,7 @@         $output         = self::cwp_frontend_post_field_container($args);          if($args['value'] != '' && is_numeric($args['value'])){-            $args['value'] = date(get_option('date_format') .' '. get_option('time_format'), $args['value']);+            $args['value'] = wp_date(get_option('date_format') .' '. get_option('time_format'), $args['value']);         }              $output .= self::cwp_frontend_field_label($args);

Vulnerability Existed: no
[Improper Neutralization of Format Strings] - [CWE-134] - [cube/fields/frontend/cubewp-frontend-date-time-picker-field.php] [Lines 47]

Old Code:
```php
$args['value'] = date(get_option('date_format') .' '. get_option('time_format'), $args['value']);
```

Fixed Code:
```php
$args['value'] = wp_date(get_option('date_format') .' '. get_option('time_format'), $args['value']);
```

Explanation:
This change represents a security improvement rather than fixing an existing vulnerability. The modification replaces PHP's native `date()` function with WordPress's `wp_date()` function. While the original code using `date()` was not inherently vulnerable to format string attacks (the format string comes from `get_option()` which is a trusted source), `wp_date()` is the WordPress-recommended approach because it:

1. Respects WordPress timezone settings (better for multi-site/international deployments)
2. Applies WordPress filters and sanitization
3. Is more maintainable within the WordPress ecosystem

The vulnerability risk was minimal in the original code since the format strings originate from WordPress options (not user input), but this change follows WordPress best practices and improves code security posture by using the framework-appropriate function.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-file-field.php	2026-01-18 00:20:47.501237530 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-file-field.php	2026-01-18 00:20:56.205778347 +0000@@ -64,7 +64,7 @@ 						'name'  => ! empty($args['custom_name']) ? $args['custom_name'] : $args['name'], 						'value' => '0', 					);-					echo cwp_render_hidden_input($input_attrs);+					echo wp_kses_post( cwp_render_hidden_input( $input_attrs ) ); 				} 				$input_attrs = array( 					'type'  => ! empty($args['type']) ? $args['type'] : 'file',@@ -74,7 +74,7 @@ 					'value' => '', 					'extra_attrs' => $args['extra_attrs'], 				);-				echo cwp_render_file_input($input_attrs);+				echo wp_kses_post( cwp_render_file_input( $input_attrs ) ); 				?> 			</div> 			<?php@@ -97,14 +97,14 @@                         </svg>                     </span> 					<img src="<?php echo esc_url($fileurl); ?>" alt="<?php echo esc_attr($filename); ?>">-					<p><?php echo basename(get_attached_file($args['value'])); ?></p>+					<p><?php echo esc_html(basename(get_attached_file($args['value']))); ?></p> 					<?php 					$input_attrs = array( 						'name'  => ! empty($args['custom_name']) ? $args['custom_name'] : $args['name'], 						'class'  => 'cwp-image-preview', 						'value' => $args['value'], 					);-					echo cwp_render_hidden_input($input_attrs);+					echo wp_kses_post( cwp_render_hidden_input( $input_attrs ) ); 					?> 				</div> 			<?php } else { ?>

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/fields/frontend/cubewp-frontend-file-field.php Lines 67, 77, 100, 107

Old Code:
```php
echo cwp_render_hidden_input($input_attrs);
echo cwp_render_file_input($input_attrs);
echo basename(get_attached_file($args['value']));
echo cwp_render_hidden_input($input_attrs);
```

Fixed Code:
```php
echo wp_kses_post( cwp_render_hidden_input( $input_attrs ) );
echo wp_kses_post( cwp_render_file_input( $input_attrs ) );
echo esc_html(basename(get_attached_file($args['value'])));
echo wp_kses_post( cwp_render_hidden_input( $input_attrs ) );
```

Explanation:
The original code directly echoed HTML output from custom rendering functions without sanitization, creating Stored/Reflected XSS vulnerabilities. An attacker could inject malicious HTML/JavaScript through file field attributes or filenames that would execute in users' browsers. The fix applies WordPress sanitization functions: `wp_kses_post()` sanitizes HTML output while preserving safe tags, and `esc_html()` escapes HTML special characters for plain text contexts. These prevent XSS by neutralizing any injected script payloads.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-gallery-field.php	2026-01-18 00:20:47.501237530 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-gallery-field.php	2026-01-18 00:20:56.205778347 +0000@@ -59,12 +59,12 @@ 				<p class="cwp-gallery-field-trigger"><?php esc_html_e("Choose Images", "cubewp-framework"); ?></p> 				<div class="cwp-gallery-field-inputs"> 					<?php-					$rand_id     = rand(123456789, 1111111111);+					$rand_id     = wp_rand(123456789, 1111111111); 					$input_attrs = array( 						'name'  => ! empty($args['custom_name']) ? $args['custom_name'] . '[]' : $args['name'], 						'value' => $rand_id, 					);-					echo cwp_render_hidden_input($input_attrs);+					echo wp_kses_post( cwp_render_hidden_input( $input_attrs ) ); 					if (isset($args["file_types"]) && !empty($args["file_types"])) { 						$accept = 'accept="' . $args["file_types"] . '"'; 					}else {@@ -78,7 +78,7 @@ 						'value'       => '', 						'extra_attrs' => $accept . ' multiple="multiple"', 					);-					echo cwp_render_file_input($input_attrs);+					echo wp_kses_post( cwp_render_file_input( $input_attrs ) ); 					?> 				</div> 			</div>@@ -103,9 +103,9 @@ 						'name'         => !empty($args['custom_name']) ? $args['custom_name'].'[]' : $args['name'], 						'value'        => $attachment_id, 					);-					$rand_id     = rand(123456789, 1111111111);+					$rand_id     = wp_rand(123456789, 1111111111); 					?>-					<div class="cwp-gallery-field-preview cloned batch-<?php esc_attr_e($rand_id); ?>" data-batch-id="batch-<?php esc_attr_e($rand_id); ?>" style="display: block;">+					<div class="cwp-gallery-field-preview cloned batch-<?php echo esc_attr($rand_id); ?>" data-batch-id="batch-<?php echo esc_attr($rand_id); ?>" style="display: block;">                         <span>                             <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" fill="currentColor" class="bi bi-x" viewBox="0 0 16 16">                                 <path d="M4.646 4.646a.5.5 0 0 1 .708 0L8 7.293l2.646-2.647a.5.5 0 0 1 .708.708L8.707 8l2.647 2.646a.5.5 0 0 1-.708.708L8 8.707l-2.646 2.647a.5.5 0 0 1-.708-.708L7.293 8 4.646 5.354a.5.5 0 0 1 0-.708z"/>@@ -113,7 +113,8 @@                         </span> 						<img src="<?php echo esc_url($fileurl); ?>" alt="image"> 						<p><?php echo esc_html($filename); ?></p>-						<?php echo cwp_render_hidden_input( $input_attrs ); ?>+						<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped+						echo cwp_render_hidden_input( $input_attrs ); ?> 					</div> 					<?php 				}

## Security Analysis Results

Based on the diff analysis of `cubewp-frontend-gallery-field.php`, here are the identified security fixes:

---

**Vulnerability 1: Insecure Random Number Generation**

Vulnerability Existed: yes
TRUE POSITIVE
Weak Cryptography - CWE-338 - cubewp-frontend-gallery-field.php Lines 62, 106
Old Code:
```php
$rand_id = rand(123456789, 1111111111);
```
Fixed Code:
```php
$rand_id = wp_rand(123456789, 1111111111);
```
Explanation:
The `rand()` function produces predictable pseudo-random numbers and should not be used for security-sensitive operations. WordPress provides `wp_rand()` which uses more secure random number generation when the system has the `random_bytes()` or `openssl_random_pseudo_bytes()` functions available. This is a security best practice in WordPress development.

---

**Vulnerability 2: Unescaped Output - Hidden Input (Line 67)**

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cubewp-frontend-gallery-field.php Line 67
Old Code:
```php
echo cwp_render_hidden_input($input_attrs);
```
Fixed Code:
```php
echo wp_kses_post( cwp_render_hidden_input( $input_attrs ) );
```
Explanation:
The output from `cwp_render_hidden_input()` was not being escaped before output. `wp_kses_post()` sanitizes the HTML output by allowing only safe tags/attributes, preventing XSS attacks if the custom function returns unescaped HTML content.

---

**Vulnerability 3: Unescaped Output - File Input (Line 81)**

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cubewp-frontend-gallery-field.php Line 81
Old Code:
```php
echo cwp_render_file_input($input_attrs);
```
Fixed Code:
```php
echo wp_kses_post( cwp_render_file_input( $input_attrs ) );
```
Explanation:
Similar to the hidden input issue, the output from `cwp_render_file_input()` lacked escaping. Adding `wp_kses_post()` ensures the HTML is sanitized before output to prevent XSS vulnerabilities.

---

**Vulnerability 4: Incorrect Output Escaping Function (Line 108)**

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cubewp-frontend-gallery-field.php Line 108
Old Code:
```php
<div class="cwp-gallery-field-preview cloned batch-<?php esc_attr_e($rand_id); ?>" data-batch-id="batch-<?php esc_attr_e($rand_id); ?>" style="display: block;">
```
Fixed Code:
```php
<div class="cwp-gallery-field-preview cloned batch-<?php echo esc_attr($rand_id); ?>" data-batch-id="batch-<?php echo esc_attr($rand_id); ?>" style="display: block;">
```
Explanation:
The code used `esc_attr_e()` which both escapes AND echoes with translation functions. This is incorrect for HTML attributes - `esc_attr()` with `echo` is the correct approach. Using `esc_attr_e()` could cause improper escaping of numeric values and is semantically wrong for untranslatable attribute values.

---

**Vulnerability 5: Unescaped Output with Suppression Comment (Line 116-117)**

Vulnerability Existed: not sure
Potential Cross-Site Scripting (XSS) - CWE-79 - cubewp-frontend-gallery-field.php Line 117
Old Code:
```php
<?php echo cwp_render_hidden_input( $input_attrs ); ?>
```
Fixed Code:
```php
<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo cwp_render_hidden_input( $input_attrs ); ?>
```
Explanation:
This location adds a PHPCS ignore comment for the unescaped output check rather than actually fixing the vulnerability. This suggests the developers believe `cwp_render_hidden_input()` returns pre-escaped HTML. However, this is potentially risky if the function's behavior changes or if `$input_attrs` contains user-controlled data. The fix suppresses the warning rather than implementing proper escaping, indicating uncertainty about whether the function's output is truly safe.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-number-field.php	2026-01-18 00:20:47.501237530 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-number-field.php	2026-01-18 00:20:56.205778347 +0000@@ -51,11 +51,15 @@     public function render_search_filters_number_field( $output = '', $args = array() ){         $args = apply_filters( 'cubewp/frontend/field/parametrs', $args );         $minval = $maxval = '';+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.         if(isset($_GET['min-'.$args['name']])){-            $minval = sanitize_text_field($_GET['min-'.$args['name']]);+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+            $minval = sanitize_text_field(wp_unslash($_GET['min-'.$args['name']]));         }+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.         if(isset($_GET['max-'.$args['name']])){-            $maxval = sanitize_text_field($_GET['max-'.$args['name']]);+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+            $maxval = sanitize_text_field(wp_unslash($_GET['max-'.$args['name']]));         }         $output         = self::cwp_frontend_search_field_container($args);             $output .= self::cwp_frontend_search_field_label($args);

Vulnerability Existed: yes
FALSE POSITIVE
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - cube/fields/frontend/cubewp-frontend-number-field.php Lines 55-56, 60-61

Old Code:
```php
$minval = sanitize_text_field($_GET['min-'.$args['name']]);
```
```php
$maxval = sanitize_text_field($_GET['max-'.$args['name']]);
```

Fixed Code:
```php
$minval = sanitize_text_field(wp_unslash($_GET['min-'.$args['name']]));
```
```php
$maxval = sanitize_text_field(wp_unslash($_GET['max-'.$args['name']]));
```

Explanation:
The vulnerability existed due to improper handling of WordPress-escaped GET parameters. When WordPress receives user input via GET/POST/REQUEST superglobals, it automatically adds slashes to the values (magic quotes behavior). The old code called `sanitize_text_field()` directly on the slashed value without first removing the escape slashes using `wp_unslash()`. 

While `sanitize_text_field()` removes some dangerous characters, it does not strip the added slashes. This means the slashes themselves would persist in the sanitized output. Additionally, the interaction between `sanitize_text_field()` and slashed input could potentially leave dangerous content unfiltered or improperly escaped, leading to XSS vulnerabilities when these values are later output to the page.

The fix properly uses `wp_unslash()` before `sanitize_text_field()` to:
1. Remove WordPress-added escape slashes
2. Apply proper sanitization to the unslashed value
3. Ensure safe handling before any output or use

This follows WordPress security best practices for handling user input from superglobals.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-repeater-field.php	2026-01-18 00:20:47.501237530 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-repeater-field.php	2026-01-18 00:20:56.205778347 +0000@@ -99,7 +99,7 @@                                             foreach($args['sub_fields'] as $sub_field){                                                 $sub_field['custom_name']  =  'cwp_user_register[custom_fields]['. $args['name'] .'][' . $sub_field['name'] . '][]';                                                 $sub_field['value']        =  isset($args['value'][$i][$sub_field['name']]) ? $args['value'][$i][$sub_field['name']] : '';-                                                $sub_field['id']           =  'cwp_'.rand(123456789, 1111111111);+                                                $sub_field['id']           =  'cwp_'.wp_rand(123456789, 1111111111);                                                 if($sub_field['type'] == 'google_address' ){                                                     $sub_field['custom_name_lat'] =   'cwp_user_register[custom_fields]['.$args['name'].'][' . $sub_field['name'].'_lat' . '][]';                                                     $sub_field['custom_name_lng'] =   'cwp_user_register[custom_fields]['.$args['name'].'][' . $sub_field['name'].'_lng' . '][]';@@ -216,7 +216,7 @@                                             foreach($args['sub_fields'] as $sub_field){                                                 $sub_field['custom_name']  =  'cwp_user_form[cwp_meta]['. $args['name'] .'][' . $sub_field['name'] . '][]';                                                 $sub_field['value']        =  isset($args['value'][$i][$sub_field['name']]) ? $args['value'][$i][$sub_field['name']] : '';-                                                $sub_field['id']           =  'cwp_'.rand(123456789, 1111111111);+                                                $sub_field['id']           =  'cwp_'.wp_rand(123456789, 1111111111);                                                 if($sub_field['type'] == 'google_address' ){                                                     $sub_field['custom_name_lat'] =   'cwp_user_form[cwp_meta]['.$args['name'].'][' . $sub_field['name'].'_lat' . '][]';                                                     $sub_field['custom_name_lng'] =   'cwp_user_form[cwp_meta]['.$args['name'].'][' . $sub_field['name'].'_lng' . '][]';@@ -335,7 +335,7 @@                                             foreach($args['sub_fields'] as $sub_field){                                                 $sub_field['custom_name']  =  'cwp_user_profile[custom_fields]['. $args['name'] .'][' . $sub_field['name'] . '][]';                                                 $sub_field['value']        =  isset($args['value'][$i][$sub_field['name']]) ? $args['value'][$i][$sub_field['name']] : '';-                                                $sub_field['id']           =  'cwp_'.rand(123456789, 1111111111);+                                                $sub_field['id']           =  'cwp_'.wp_rand(123456789, 1111111111);                                                 if($sub_field['type'] == 'google_address' ){                                                     $sub_field['custom_name_lat'] =   'cwp_user_profile[custom_fields]['.$args['name'].'][' . $sub_field['name'].'_lat' . '][]';                                                     $sub_field['custom_name_lng'] =   'cwp_user_profile[custom_fields]['.$args['name'].'][' . $sub_field['name'].'_lng' . '][]';

# Security Analysis Report

## Vulnerability 1

**Vulnerability Existed:** yes

**Insecure Randomness - CWE-338** - cube/fields/frontend/cubewp-frontend-repeater-field.php [Lines 102, 219, 338]

**Old Code:**
```php
$sub_field['id'] = 'cwp_'.rand(123456789, 1111111111);
```

**Fixed Code:**
```php
$sub_field['id'] = 'cwp_'.wp_rand(123456789, 1111111111);
```

**Explanation:**
The code was using PHP's built-in `rand()` function to generate random IDs for HTML elements. The `rand()` function is not cryptographically secure and produces predictable sequences, making it unsuitable for security-sensitive operations. The fix replaces `rand()` with `wp_rand()`, which is WordPress's wrapper function that uses more secure randomization methods (mt_rand() with additional seeding in WordPress). While this is not a critical security vulnerability for generating HTML element IDs (which are not security-critical), using insecure randomness for any ID generation is a poor security practice. This fix improves the code quality by following WordPress best practices for random number generation. All three occurrences at lines 102, 219, and 338 have been corrected.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-time-picker-field.php	2026-01-18 00:20:47.505237778 +0000+++ cache/cubewp-framework_1.1.28/cube/fields/frontend/cubewp-frontend-time-picker-field.php	2026-01-18 00:20:56.205778347 +0000@@ -44,7 +44,7 @@         $output         = self::cwp_frontend_post_field_container($args);                  if($args['value'] != '' && is_numeric($args['value'])){-            $args['value'] = date(get_option('time_format'), $args['value']);+            $args['value'] = wp_date(get_option('time_format'), $args['value']);         }             $output .= self::cwp_frontend_field_label($args);             $input_attrs = array( 

Vulnerability Existed: yes
TRUE POSITIVE
Improper Timezone Handling - CWE-382 - cubewp-framework_1.1.27/cube/fields/frontend/cubewp-frontend-time-picker-field.php Line 47

Old Code:
```php
$args['value'] = date(get_option('time_format'), $args['value']);
```

Fixed Code:
```php
$args['value'] = wp_date(get_option('time_format'), $args['value']);
```

Explanation:
The vulnerability involves improper timezone handling. The native PHP `date()` function operates in the server's system timezone and does not respect WordPress timezone settings configured via the WordPress admin dashboard. By replacing it with `wp_date()`, the fix ensures that date formatting respects the site's configured timezone (set in Settings > General > Timezone). This prevents timezone mismatches that could cause incorrect time display for users in different timezones or sites with non-UTC timezone configurations. The `wp_date()` function is WordPress's timezone-aware wrapper that properly applies the site's timezone offset to date formatting operations.

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

--- cache/cubewp-framework_1.1.27/cube/functions/admin-functions.php	2026-01-18 00:20:47.505237778 +0000+++ cache/cubewp-framework_1.1.28/cube/functions/admin-functions.php	2026-01-18 00:20:56.209778596 +0000@@ -6,6 +6,9 @@  * @version 1.0  * @package cubewp/cube/functions  */++// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals+ if (! defined('ABSPATH')) { 	exit; }@@ -207,13 +210,22 @@  *  * @return array $terms List of Terms.  */-if (! function_exists("cwp_all_terms_by")) {+if (! function_exists('cwp_all_terms_by')) { 	function cwp_all_terms_by($taxonomy = '') 	{-		return get_terms($taxonomy, array('hide_empty' => false));++		if (empty($taxonomy)) {+			return array();+		}++		return get_terms(array(+			'taxonomy'   => $taxonomy,+			'hide_empty' => false,+		)); 	} } + /**  * Method get_terms_by_post_type_or_types  *@@ -453,7 +465,7 @@ 				$savePosts = (array) $savePosts; 			} 		} else {-			$savePosts = (isset($_COOKIE['CWP_Saved'])) ? explode(',', (string) sanitize_text_field($_COOKIE['CWP_Saved'])) : array();+			$savePosts = (isset($_COOKIE['CWP_Saved'])) ? explode(',', (string) sanitize_text_field(wp_unslash($_COOKIE['CWP_Saved']))) : array(); 			$savePosts = array_map('absint', $savePosts); // Clean cookie input, it's user input! 		} 		if ($class) {@@ -513,6 +525,21 @@ 	{ 		$post_type = get_post_type($post_id); 		$post_card = include(CUBEWP_FILES . 'templates/post-card.php');++		// Check if style includes _cwp_elmentor_ or not+		if (strpos($style, '_cwp_elmentor_') !== false) {+			$maybe_elementor = cwp_maybe_render_elementor_postcard_by_style($style, $post_id, $col_class);+			if (! empty($maybe_elementor)) {+				$post_card = $maybe_elementor;+			}+		}++		$PRIMARY_POSTCARD = cwp_get_elemetor_primary_postcard_by_type($post_type);+		if (!empty($PRIMARY_POSTCARD) && !$style) {+			$post_card = cubewp_elementor_loop_html_process($post_id, $PRIMARY_POSTCARD, $col_class);+		}++		//check if dynamic layout exist 		if (function_exists('cubewp_get_loop_builder_by_post_type')) { 			$dynamic_layout = cubewp_get_loop_builder_by_post_type(get_post_type($post_id), $style, $post_id); 			if (!empty($dynamic_layout)) {@@ -523,11 +550,125 @@ 		$postID_for_stats = '<span class="cwp-post-hidden-id" data-cwp-stats-posttype="' . $post_type . '" data-cwp-stats-postid="' . $post_id . '" style="display:none !important;"></span>'; 		$insert_position = strpos($post_card, '</div>'); 		$output = substr_replace($post_card, $postID_for_stats, $insert_position, 0);+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 		echo apply_filters('cubewp/frontend/loop/grid/html', $output, $post_id, $col_class, $style); 		return ob_get_clean(); 	} } +/**+ * Resolve an Elementor post card style key (ID or slug) and render HTML.+ *+ * Accepts styles like `_cwp_elmentor_{id}` or `_cwp_elmentor_{slug}`.+ * Returns rendered HTML string or empty string if not resolved.+ */+if (!function_exists('cwp_maybe_render_elementor_postcard_by_style')) {+	function cwp_maybe_render_elementor_postcard_by_style($style, $post_id, $col_class = 'cwp-col-12 cwp-col-md-6')+	{+		if (strpos($style, '_cwp_elmentor_') === false) {+			return '';+		}+		$elementor_key = str_replace('_cwp_elmentor_', '', $style);+		$elementor_post_id = 0;+		// If numeric, treat as post ID (backward compatible)+		if (ctype_digit((string) $elementor_key)) {+			$elementor_post_id = (int) $elementor_key;+		} else {+			// Otherwise treat as slug and resolve to ID+			$maybe_post = get_page_by_path($elementor_key, OBJECT, 'cubewp-tb');+			if ($maybe_post && ! is_wp_error($maybe_post)) {+				$elementor_post_id = (int) $maybe_post->ID;+			} else {+				// Fallback resolution by name query+				$by_name = get_posts(array(+					'post_type'      => 'cubewp-tb',+					'name'           => $elementor_key,+					'posts_per_page' => 1,+					'fields'         => 'ids',+				));+				if (! empty($by_name)) {+					$elementor_post_id = (int) $by_name[0];+				}+			}+		}+		if ($elementor_post_id) {+			return cubewp_elementor_loop_html_process($post_id, $elementor_post_id, $col_class);+		}+		return '';+	}+}++/**+ * Method cubewp_elementor_loop_html_process+ *+ * @param int    $post_id+ * @param int    $elementor_template_id+ * @param string $col_class+ *+ * @return string html+ * @since  1.1.28+ */+if (!function_exists("cubewp_elementor_loop_html_process")) {+	function cubewp_elementor_loop_html_process($post_id, $elementor_template_id, $col_class = 'cwp-col-12 cwp-col-md-6')+	{+		static $processed_templates = [];++		$default_col_class = get_post_meta($elementor_template_id, 'default_col_class', true);+		if (!empty($default_col_class)) {+			$col_class = $default_col_class;+		}+		$col_class .= ' cwp-elementor-post-card';++		ob_start();+		echo '<div class="' . esc_attr(implode(' ', get_post_class($col_class, $post_id))) . '">';++		// Check if we've already processed this template+		if (!in_array($elementor_template_id, $processed_templates)) {+			// First time - output with styles+			CubeWp_Theme_Builder::do_cubewp_theme_builder('postcard', $elementor_template_id);+			$processed_templates[] = $elementor_template_id;+		} else {+			// Subsequent times - output without styles+			$content = cwp_get_elementor_content_without_styles($elementor_template_id);+			// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped+			echo $content;+		}++		echo '</div>';+		return ob_get_clean();+	}+}++/**+ * Method cwp_get_elementor_content_without_styles+ *+ * @param int $template_id+ *+ * @return string html+ * @since  1.1.28+ */+if (!function_exists('cwp_get_elementor_content_without_styles')) {+	function cwp_get_elementor_content_without_styles($template_id)+	{+		if (empty($template_id)) return '';++		if (class_exists('\Elementor\Frontend')) {+			$elementor_frontend_builder = new \Elementor\Frontend();+			$elementor_frontend_builder->init();++			// Get the content without printing CSS+			$content = $elementor_frontend_builder->get_builder_content($template_id, false);++			// Remove style tags from the content+			$content = preg_replace('/<style[^>]*>.*?<\/style>/is', '', $content);++			return $content;+		}++		return '';+	}+}+ if (! function_exists('cubewp_get_loop_builder_by_post_type')) { 	function cubewp_get_loop_builder_by_post_type($post_type, $style = false, $post_id = '') 	{@@ -569,20 +710,34 @@ ?> 		<div class="cwp-single-widget cwp-admin-widget"> 			<div class="cwp-single-author-img">-				<img src="<?php echo get_avatar_url($user_id, ["size" => "52"]) ?>"-					alt="<?php esc_html__("Post Author", "cubewp") ?>" />+				<img src="<?php echo esc_url(get_avatar_url($user_id, ["size" => "52"])) ?>"+					alt="<?php esc_html__("Post Author", "cubewp-framework") ?>" /> 			</div> 			<div class="cwp-single-author-detail"> 				<div class="cwp-single-author-name">-					<a href="<?php echo esc_url($author_page_url) ?>"><?php echo get_the_author_meta("display_name", $user_id) ?></a>+					<a href="<?php echo esc_url($author_page_url) ?>"><?php echo esc_html(get_the_author_meta("display_name", $user_id)) ?></a> 				</div>-				<?php echo get_author_contact_info($user_id); ?>+				<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped+				echo get_author_contact_info($user_id); ?> 			</div> 		</div> 	<?php 		return ob_get_clean(); 	} }++if (!function_exists('cubewp_get_user_details')) {+	function cubewp_get_user_details($user_id)+	{+		if (empty($user_id)) {+			return '';+		}+		/* Calliing my own function to avoid the deprecated function warning */+		/* phpcs:ignore WordPress.WP.DeprecatedFunctions.get_user_detailsFound */+		return get_user_details($user_id);+	}+}+ /**  * Method get_author_contact_info  *@@ -608,7 +763,7 @@ 				</svg> 			</li> 			<li>-				<a href="mailto:<?php echo $user_email ?>">+				<a href="mailto:<?php echo esc_url($user_email) ?>"> 					<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" 						viewBox="0 0 16 16"> 						<path d="M.05 3.555A2 2 0 0 1 2 2h12a2 2 0 0 1 1.95 1.555L8 8.414.05 3.555ZM0 4.697v7.104l5.803-3.558L0 4.697ZM6.761 8.83l-6.57 4.027A2 2 0 0 0 2 14h12a2 2 0 0 0 1.808-1.144l-6.57-4.027L8 9.586l-1.239-.757Zm3.436-.586L16 11.801V4.697l-5.803 3.546Z" />@@ -616,7 +771,7 @@ 				</a> 			</li> 			<?php if (!empty($user_url)) { ?>-				<li><a target="_blank" href="<?php echo  $user_url ?>"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">+				<li><a target="_blank" href="<?php echo esc_url($user_url) ?>"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16"> 							<path d="M0 8a8 8 0 1 1 16 0A8 8 0 0 1 0 8zm7.5-6.923c-.67.204-1.335.82-1.887 1.855A7.97 7.97 0 0 0 5.145 4H7.5V1.077zM4.09 4a9.267 9.267 0 0 1 .64-1.539 6.7 6.7 0 0 1 .597-.933A7.025 7.025 0 0 0 2.255 4H4.09zm-.582 3.5c.03-.877.138-1.718.312-2.5H1.674a6.958 6.958 0 0 0-.656 2.5h2.49zM4.847 5a12.5 12.5 0 0 0-.338 2.5H7.5V5H4.847zM8.5 5v2.5h2.99a12.495 12.495 0 0 0-.337-2.5H8.5zM4.51 8.5a12.5 12.5 0 0 0 .337 2.5H7.5V8.5H4.51zm3.99 0V11h2.653c.187-.765.306-1.608.338-2.5H8.5zM5.145 12c.138.386.295.744.468 1.068.552 1.035 1.218 1.65 1.887 1.855V12H5.145zm.182 2.472a6.696 6.696 0 0 1-.597-.933A9.268 9.268 0 0 1 4.09 12H2.255a7.024 7.024 0 0 0 3.072 2.472zM3.82 11a13.652 13.652 0 0 1-.312-2.5h-2.49c.062.89.291 1.733.656 2.5H3.82zm6.853 3.472A7.024 7.024 0 0 0 13.745 12H11.91a9.27 9.27 0 0 1-.64 1.539 6.688 6.688 0 0 1-.597.933zM8.5 12v2.923c.67-.204 1.335-.82 1.887-1.855.173-.324.33-.682.468-1.068H8.5zm3.68-1h2.146c.365-.767.594-1.61.656-2.5h-2.49a13.65 13.65 0 0 1-.312 2.5zm2.802-3.5a6.959 6.959 0 0 0-.656-2.5H12.18c.174.782.282 1.623.312 2.5h2.49zM11.27 2.461c.247.464.462.98.64 1.539h1.835a7.024 7.024 0 0 0-3.072-2.472c.218.284.418.598.597.933zM10.855 4a7.966 7.966 0 0 0-.468-1.068C9.835 1.897 9.17 1.282 8.5 1.077V4h2.355z" /> 						</svg></a></li> 			<?php } ?>@@ -781,7 +936,7 @@ 			'post_type'   => 'cwp_form_fields', 			'post_status' => array('private', 'publish'), 			'fields'      => 'ids',-			'meta_query'  => array(+			'meta_query'  => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 				array( 					'key'     => '_cwp_group_types', 					'value'   => $type,@@ -1004,6 +1159,245 @@ }  /**+ * Method cubewp_get_svg_content+ *+ * @param array $icon+ *+ * @return string+ * @since  1.1.28+ */+if (! function_exists("cubewp_get_svg_content")) {+	function cubewp_get_svg_content($icon)+	{+		// If icon is array, process it+		if (is_array($icon)) {+			// First, try to get from attachment ID (most reliable for local files)+			if (isset($icon['value']['id']) && is_numeric($icon['value']['id'])) {+				$file_path = get_attached_file($icon['value']['id']);++				if ($file_path && file_exists($file_path)) {+					$svg_content = file_get_contents($file_path);+					if (!empty($svg_content) && is_string($svg_content)) {+						return $svg_content;+					}+				}+			}++			// If ID method failed, try to fetch from URL+			if (isset($icon['value']['url']) && is_string($icon['value']['url'])) {+				$url = $icon['url'];+				// For local URLs, try direct file access first+				if (strpos($url, site_url()) === 0 || strpos($url, home_url()) === 0) {+					$file_path = str_replace(site_url('/'), ABSPATH, $url);+					$file_path = str_replace(home_url('/'), ABSPATH, $file_path);+					if (file_exists($file_path)) {+						$svg_content = file_get_contents($file_path);+						if (!empty($svg_content) && is_string($svg_content)) {+							return $svg_content;+						}+					}+				}+				// Try remote fetch as fallback+				$response = wp_safe_remote_get($url, array(+					'timeout' => 10,+					'sslverify' => false+				));+				if (!is_wp_error($response) && 200 === wp_remote_retrieve_response_code($response)) {+					$svg_content = wp_remote_retrieve_body($response);+					if (!empty($svg_content) && is_string($svg_content)) {+						return $svg_content;+					}+				}+				// Last resort: return the URL as string (for icon classes, not SVG)+				return $url;+			}++			// If icon is array with 'value', return it+			if (isset($icon['value']) && is_string($icon['value'])) {+				return $icon['value'];+			}++			// If nothing worked, return empty string+			return '';+		}++		// If icon is string, return it+		if (is_string($icon)) {+			return $icon;+		}++		// Fallback: return empty string+		return '';+	}+}++/**+ * Method cubewp_kses_allowed_svg+ *+ * @return array+ * @since  1.1.28+ */+if (! function_exists("cubewp_kses_allowed_svg")) {+	function cubewp_kses_allowed_svg()+	{+		// Start with the allowed HTML for posts (common HTML tags)+		$allowed = wp_kses_allowed_html('post');+		// Add commonly used SVG tags and their safe attributes+		$svg_allowed = array(+			'svg' => array(+				'xmlns'       => true,+				'width'       => true,+				'height'      => true,+				'viewBox'     => true,+				'preserveAspectRatio' => true,+				'role'        => true,+				'class'       => true,+				'aria-hidden' => true,+				'aria-label'  => true,+				'focusable'   => true,+				'fill'        => true,+				'stroke'      => true,+				'style'       => true,+			),+			'g' => array(+				'fill'   => true,+				'stroke' => true,+				'class'  => true,+				'style'  => true,+				'transform' => true,+			),+			'path' => array(+				'd'         => true,+				'fill'      => true,+				'stroke'    => true,+				'class'     => true,+				'style'     => true,+				'transform' => true,+			),+			'circle' => array(+				'cx' => true,+				'cy' => true,+				'r'  => true,+				'fill' => true,+				'stroke' => true,+				'class' => true,+				'style' => true,+			),+			'rect' => array(+				'x' => true,+				'y' => true,+				'width' => true,+				'height' => true,+				'rx' => true,+				'ry' => true,+				'fill' => true,+				'stroke' => true,+				'class' => true,+				'style' => true,+			),+			'line' => array(+				'x1' => true,+				'y1' => true,+				'x2' => true,+				'y2' => true,+				'stroke' => true,+				'class' => true,+				'style' => true,+			),+			'polyline' => array(+				'points' => true,+				'fill' => true,+				'stroke' => true,+				'class' => true,+				'style' => true,+			),+			'polygon' => array(+				'points' => true,+				'fill' => true,+				'stroke' => true,+				'class' => true,+				'style' => true,+			),+			'defs' => array(),+			'title' => array(),+			'desc' => array(),+			'use' => array(+				'href' => true, // in modern browsers xlink:href is deprecated; if you use xlink, include it explicitly+				'xlink:href' => true,+				'x' => true,+				'y' => true,+				'width' => true,+				'height' => true,+				'class' => true,+			),+			'symbol' => array(+				'id' => true,+				'viewBox' => true,+				'preserveAspectRatio' => true,+				'class' => true,+			),+			'linearGradient' => array('id' => true, 'x1' => true, 'x2' => true, 'y1' => true, 'y2' => true),+			'stop' => array('offset' => true, 'stop-color' => true, 'stop-opacity' => true),+		);++		return array_merge($allowed, $svg_allowed);+	}+}++/**+ * Method cubewp_kses_allowed_protocols+ *+ * @return array+ * @since  1.1.28+ */+if (! function_exists("cubewp_kses_allowed_protocols")) {+	function cubewp_kses_allowed_protocols( $protocols = array() ) {+		if ( ! in_array( 'data', $protocols, true ) ) {+			$protocols[] = 'data';+		}+		return $protocols;+	}+	add_filter( 'kses_allowed_protocols', 'cubewp_kses_allowed_protocols', 10, 1 );+}++/**+ * Method cubewp_kses_allowed_html+ *+ * @return array+ * @since  1.1.28+ */+if (! function_exists("cubewp_kses_allowed_html")) {+	function cubewp_kses_allowed_html( $allowed = array(), $context = 'post') {+		if ( $context !== 'post' ) {+			return $allowed;+		}+		$allowed['svg'] = [+			'class'       => true,+			'aria-hidden' => true,+			'aria-label'  => true,+			'role'        => true,+			'xmlns'       => true,+			'width'       => true,+			'height'      => true,+			'viewBox'     => true,+			'fill'        => true,+		];+		$allowed['path'] = [+			'd'    => true,+			'fill' => true,+		];+		$allowed['span'] = [+			'class' => true,+		];+		$allowed['div'] = [+			'class' => true,+		];+		return $allowed;+	}+	add_filter( 'wp_kses_allowed_html', 'cubewp_kses_allowed_html', 10, 2 );+}++/**  * Method cwp_get_opt_hook  *  * @param string $type@@ -1386,7 +1780,9 @@ 			'elementor_library_direct_actions', 		]; -		if (isset($_REQUEST['action']) && in_array($_REQUEST['action'], $actions)) {+		// Read-only check for Elementor editor context; no data is modified here.+		$req_action = isset($_REQUEST['action']) ? sanitize_key(wp_unslash($_REQUEST['action'])) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended+		if ($req_action && in_array($req_action, $actions, true)) { 			return true; 		} @@ -1397,8 +1793,13 @@ if (! function_exists("cubewp_get_elementor_preview_post_id")) { 	function cubewp_get_elementor_preview_post_id() 	{--		return (isset($_GET['tb_demo_id']) && !empty($_GET['tb_demo_id'])) ? $_GET['tb_demo_id'] : '';+		$post_id = '';+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+		if (isset($_GET['tb_demo_id']) && $_GET['tb_demo_id'] !== '') {+			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+			$post_id = absint(wp_unslash($_GET['tb_demo_id']));+		}+		return apply_filters('cubewp_elementor_preview_post_id', $post_id); 	} } @@ -1499,7 +1900,7 @@ 			'numberposts' => -1, 			'fields'      => 'ids', 			'post_type'   => 'cwp_form_fields',-			'meta_query'  => $meta_query+			'meta_query'  => $meta_query // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 		);  		$allGroups = get_posts($args);@@ -1569,6 +1970,8 @@ 	function cwp_pre($data = array(), $die = false) 	{ 		echo '<pre>';+		// Helps to print the data in a readable format.+		// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r 		print_r($data); 		echo '</pre>'; 		if ($die == true) {@@ -1626,6 +2029,34 @@ }  /**+ * Method cubewp_get_taxonomy_fields_by_type+ *+ * @param array $allowed_types+ *+ * @return array+ * @since  1.1.28+ */+if (! function_exists("cubewp_get_taxonomy_fields_by_type")) {+	function cubewp_get_taxonomy_fields_by_type(array $allowed_types)+	{+		$_data = array();+		$taxonomy_custom_fields = CWP()->get_custom_fields('taxonomy');+		if (!empty($taxonomy_custom_fields) && is_array($taxonomy_custom_fields)) {+			foreach ($taxonomy_custom_fields as $taxonomy => $fields) {+				if (!empty($fields) && is_array($fields)) {+					foreach ($fields as $field) {+						if (in_array($field['type'], $allowed_types)) {+							$_data[$field['slug']] = $field['name'];+						}+					}+				}+			}+		}+		return $_data;+	}+}++/**  * Method cwp_get_categories_by_taxonomy  *  * @param array  $taxonomy@@ -1828,7 +2259,7 @@ 			'numberposts' => -1, 			'post_type'   => 'cwp_user_fields', 			'fields'      => 'ids',-			'meta_query'  => array(+			'meta_query'  => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 				array( 					'key'     => '_cwp_group_user_roles', 					'value'   => $user_role,@@ -2048,12 +2479,26 @@ 	function _get_post_type($type = '') 	{ 		if (empty($type)) {-			if (isset($_GET['post_type']) && $_GET['post_type'] != '') {-				$post_type = sanitize_text_field($_GET['post_type']);-			} else if (is_tax()) {-				$post_type = get_taxonomy(get_queried_object()->taxonomy)->object_type[0];+			// Read-only context: determining post type; no state mutation.+			// phpcs:ignore WordPress.Security.NonceVerification.Recommended+			$raw_get_post_type = isset($_GET['post_type']) ? sanitize_text_field(wp_unslash($_GET['post_type'])) : '';+			if ($raw_get_post_type !== '') {+				$post_type = sanitize_key($raw_get_post_type);+			} elseif (is_tax()) {+				$qo  = get_queried_object();+				$tax = $qo && isset($qo->taxonomy) ? get_taxonomy($qo->taxonomy) : null;+				if ($tax && ! empty($tax->object_type) && is_array($tax->object_type)) {+					$post_type = sanitize_key(reset($tax->object_type));+				} else {+					$post_type = '';+				} 			} else {-				$post_type = isset($_GET['post_type']) ? sanitize_text_field($_GET['post_type']) : get_queried_object()->name;+				// Fallback to queried object name if present.+				$qo        = get_queried_object();+				$fallback  = ($qo && isset($qo->name)) ? $qo->name : '';+				// phpcs:ignore WordPress.Security.NonceVerification.Recommended+				$second_raw = isset($_GET['post_type']) ? sanitize_text_field(wp_unslash($_GET['post_type'])) : '';+				$post_type  = $second_raw !== '' ? sanitize_key($second_raw) : sanitize_key($fallback); 			}  			return $post_type;@@ -2231,7 +2676,7 @@ if (! function_exists("cubewp_single_page_template")) { 	function cubewp_single_page_template($post_templates, $wp_theme, $post, $post_type) 	{-		$post_templates['cubewp-template-single.php'] = esc_html__("CubeWP Single Post", "cubewp-frontend");+		$post_templates['cubewp-template-single.php'] = esc_html__("CubeWP Single Post", "cubewp-framework");  		return $post_templates; 	}@@ -2340,18 +2785,20 @@ if (! function_exists('cubewp_get_current_url')) { 	function cubewp_get_current_url() 	{-		if (-			isset($_SERVER['HTTPS']) &&-			($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1) ||-			isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&-			$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'-		) {-			$protocol = 'https://';-		} else {-			$protocol = 'http://';-		}+		// Derive scheme safely.+		$scheme = is_ssl() ? 'https://' : 'http://';+		// Build host and request URI from $_SERVER with checks and sanitization.+		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated,WordPress.Security.NonceVerification.Recommended+		$raw_host = isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '';+		// Sanitize host; fallback to empty string if not present.+		$host = $raw_host !== '' ? strtolower(sanitize_text_field($raw_host)) : '';+		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated,WordPress.Security.NonceVerification.Recommended+		$raw_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';+		// Sanitize path/query portion.+		$uri = $raw_uri !== '' ? esc_url_raw($raw_uri) : '/'; -		return esc_url($protocol . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);+		$url = $scheme . $host . $uri;+		return esc_url($url); 	} } @@ -2359,8 +2806,10 @@ 	function cwp_get_post_card_view() 	{ 		$card_view = 'grid-view';-		if (isset($_COOKIE['cwp_archive_switcher']) && !empty($_COOKIE['cwp_archive_switcher'])) {-			$card_view = esc_html($_COOKIE['cwp_archive_switcher']);+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+		$cookie_value = isset($_COOKIE['cwp_archive_switcher']) ? sanitize_text_field(wp_unslash($_COOKIE['cwp_archive_switcher'])) : '';+		if ($cookie_value !== '') {+			$card_view =  $cookie_value; 		} 		return $card_view; 	}@@ -2451,8 +2900,9 @@ 			// Remove the custom post type from the admin menu 			remove_menu_page('edit.php?post_type=' . $slug); 			// Redirect subscribers if they try to access the custom post type page directly-			if (isset($_GET['post_type']) && $_GET['post_type'] == $slug) {-				wp_redirect(admin_url());+			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of query vars to render notice; no state change performed.+			if (isset($_GET['post_type']) && sanitize_text_field(wp_unslash($_GET['post_type'])) == $slug) {+				wp_safe_redirect(admin_url()); 				exit; 			} 		}@@ -2487,6 +2937,10 @@ 			$cubewp_styles = apply_filters('cubewp/post/card/styles', $cubewp_cards[$post_type]['loop-styles'], $post_type); 		} 	}+	$elementor_postcard_styles = cwp_get_elemetor_postcards_by_type($post_type);+	if (!empty($elementor_postcard_styles)) {+		$cubewp_styles = array_merge($cubewp_styles, $elementor_postcard_styles);+	} 	return $cubewp_styles; } @@ -2655,17 +3109,17 @@ 		$return = get_the_title($post_id); 	} else if ($field == 'the_excerpt') { 		$return = get_the_excerpt($post_id);-	} else if ($field == 'the_content') {-		$post_content = strip_tags(get_the_content('', '', $post_id));-		$words = str_word_count($post_content, 2);-		$pos = array_keys($words);-		$return = substr($post_content, 0, $pos[10]) . '...';+	} else if ($field === 'the_content') {+		$post_content = get_the_content(null, false, $post_id);+		$post_content = wp_strip_all_tags($post_content);+		$return = wp_trim_words($post_content, 10, '...'); 	} else if ($field == 'post_link') { 		$return = get_the_permalink($post_id); 	} else if ($field == 'the_date') { 		$return = get_the_date('', $post_id); 	} else if ($field == 'post_class') { 		ob_start();+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 		echo post_class($attributes); 		return ob_get_clean(); 		ob_end_flush();@@ -2888,7 +3342,7 @@ 	{ 		$args = array( 			'post_type'      => 'cubewp-tb',-			'meta_query'     => array(+			'meta_query'     => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query 				array('key' => 'template_location', 'value' => 'cubewp_post_loop_promotional_card', 'compare' => '=',), 			), 			'posts_per_page' => -1,@@ -2919,6 +3373,7 @@ 			if (class_exists('\Elementor\Plugin') && \Elementor\Plugin::$instance->documents) { 				$document = \Elementor\Plugin::$instance->documents->get($promotional_cardID); 				if ($document && $document->is_built_with_elementor()) {+					// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped 					echo \Elementor\Plugin::$instance->frontend->get_builder_content_for_display($promotional_cardID); 				} 			}@@ -2929,3 +3384,1113 @@ 		return ob_get_clean(); 	} }++/** ------------ Theme Builder Post Card & Term Card ------------ */++/**+ * Method cubewp_register_postcard_page_controls+ *+ * @param $element + *+ * @return void+ */+if (!function_exists('cubewp_register_postcard_page_controls')) {+	function cubewp_register_postcard_page_controls($element)+	{+		if (! $element instanceof \Elementor\Core\DocumentTypes\PageBase || ! $element::get_property('has_elements')) {+			return;+		}++		$post_id = get_the_ID();+		$template_type = get_post_meta($post_id, 'template_type', true);++		if (get_post_type($post_id) == 'cubewp-tb' && $template_type == 'postcard') {+			$template_location = get_post_meta($post_id, 'template_location', true);+			$associated_post_type = $template_location ? str_replace('postcard_', '', $template_location) : '';+			$preview_post_id      = get_post_meta($post_id, 'preview_post_id', true);+			$primary_post_card    = get_post_meta($post_id, 'primary_post_card', true);+			$posts = array();+			if ($associated_post_type) {+				$args = array(+					'post_type'      => $associated_post_type,+					'posts_per_page' => 10,+					'orderby'        => 'date',+					'order'          => 'DESC',+					'fields'         => 'ids'+				);++				// Fetch the posts+				$options = get_posts($args);++				if (is_array($options) && !empty($options)) {+					foreach ($options as $option) {+						$posts[$option] = get_the_title($option);+					}+				}+			}+			$element->start_controls_section(+				'postcard_section',+				[+					'label' => __('Post Card Settings', 'cubewp-framework'),+					'tab' => \Elementor\Controls_Manager::TAB_SETTINGS,+				]+			);++			$element->add_control(+				'preview_post_id',+				[+					'label' => __('Select Post for Preview', 'cubewp-framework'),+					'type' => \Elementor\Controls_Manager::SELECT2,+					'options' => $posts,+					'description' => __('Select a post to preview the postcard template. This selection will not affect the actual posts displayed on the front end.', 'cubewp-framework'),+					'default' => $preview_post_id ? $preview_post_id : '',+					'render_type' => 'ui',+					'frontend_available' => true,+				]+			);++			$element->add_control(+				'primary_post_card',+				[+					'label'        => __('Make this Post-Card primary for this Post-Type', 'cubewp-framework'),+					'type'         => \Elementor\Controls_Manager::SWITCHER,+					'label_on'     => __('Yes', 'cubewp-framework'),+					'label_off'    => __('No', 'cubewp-framework'),+					'return_value' => 'yes',+					'default'      => $primary_post_card ? $primary_post_card : 'no',+					'description'  => __('Enable this option to make this postcard the primary template for the associated post type.', 'cubewp-framework'),+				]+			);++			$element->add_control(+				'default_col_class',+				[+					'label'        => __('Default Coloumn Class', 'cubewp-framework'),+					'type'         => \Elementor\Controls_Manager::TEXT,+					'default'      => 'cwp-col-12 cwp-col-md-6 cwp-col-lg-4',+					'description'  => __('Add custom CSS classes to the post card container for additional styling.', 'cubewp-framework'),+				]+			);++			$element->end_controls_section();+		}++		if (get_post_type($post_id) == 'cubewp-tb' && $template_type == 'termcard') {+			$template_location   = get_post_meta($post_id, 'template_location', true);+			$associated_taxonomy = $template_location ? str_replace('termcard_', '', $template_location) : '';+			$preview_term_slug     = get_post_meta($post_id, 'preview_term_slug', true);++			$terms = [];+			if ($associated_taxonomy) {+				$options = get_terms([+					'taxonomy'   => $associated_taxonomy,+					'hide_empty' => false,+					'number'     => 50,+				]);++				if (!is_wp_error($options) && !empty($options)) {+					foreach ($options as $term) {+						$terms[$term->slug] = $term->name;+					}+				}+			}++			if (empty($preview_term_slug) && !empty($terms)) {+				$preview_term_slug = array_key_first($terms);+			}++			$element->start_controls_section(+				'termcard_section',+				[+					'label' => __('Term Card Settings', 'cubewp-framework'),+					'tab'   => \Elementor\Controls_Manager::TAB_SETTINGS,+				]+			);++			$element->add_control(+				'preview_term_slug',+				[+					'label'              => __('Select Term for Preview', 'cubewp-framework'),+					'type'               => \Elementor\Controls_Manager::SELECT2,+					'options'            => $terms,+					'description'        => __('Select a term to preview this term card. This only affects the builder view.', 'cubewp-framework'),+					'default'            => $preview_term_slug ? $preview_term_slug : '',+					'render_type'        => 'ui',+					'frontend_available' => true,+				]+			);++			$element->end_controls_section();+		}+	}+	add_action('elementor/documents/register_controls', 'cubewp_register_postcard_page_controls');+}++/**+ * Method cubewp_save_elementor_postcard_settings+ *+ * @param $document + * @param $data + *+ * @return void+ */+if (!function_exists('cubewp_save_elementor_postcard_settings')) {+	function cubewp_save_elementor_postcard_settings($document, $data)+	{+		$post_id = $document->get_main_id();++		if (get_post_type($post_id) === 'cubewp-tb') {+			if (isset($data['settings']['preview_post_id'])) {+				update_post_meta($post_id, 'preview_post_id', $data['settings']['preview_post_id']);+			}++			if (isset($data['settings']['default_col_class'])) {+				update_post_meta($post_id, 'default_col_class', $data['settings']['default_col_class']);+			}++			// Handle Primary Postcard Logic+			$primary_post_card = isset($data['settings']['primary_post_card']) ? $data['settings']['primary_post_card'] : 'no';+			update_post_meta($post_id, 'primary_post_card', $primary_post_card);++			if ($primary_post_card === 'yes') {+				cubewp_disable_other_elementor_primary_postcards($post_id);+			}++			if (isset($data['settings']['preview_term_slug'])) {+				update_post_meta($post_id, 'preview_term_slug', $data['settings']['preview_term_slug']);+			}+		}+	}+	add_action('elementor/document/after_save', 'cubewp_save_elementor_postcard_settings', 10, 2);+}++/**+ * Disable other primary postcards for the same post type+ *+ * @param int $current_post_id+ * @return void+ */+if (!function_exists('cubewp_disable_other_elementor_primary_postcards')) {+	function cubewp_disable_other_elementor_primary_postcards($current_post_id)+	{+		$template_location = get_post_meta($current_post_id, 'template_location', true);+		$associated_post_type = $template_location ? str_replace('postcard_', '', $template_location) : '';++		if (empty($associated_post_type)) {+			return;+		}++		$args = array(+			'post_type'      => 'cubewp-tb',+			'fields'         => 'ids',+			'post__not_in'   => array($current_post_id), // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in+			'meta_query'     => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query+				'relation' => 'AND',+				array(+					'key'     => 'template_type',+					'value'   => 'postcard',+					'compare' => '=',+				),+				array(+					'key'     => 'template_location',+					'value'   => 'postcard_' . $associated_post_type,+					'compare' => '=',+				),+				array(+					'key'     => 'primary_post_card',+					'value'   => 'yes',+					'compare' => '=',+				),+			),+		);++		$other_postcards = get_posts($args);++		if (!empty($other_postcards)) {+			foreach ($other_postcards as $other_id) {+				update_post_meta($other_id, 'primary_post_card', 'no');+			}+		}+	}+}++/**+ * Method cubewp_elementor_preview_post_id+ *+ * @param $preview_id + *+ * @return int+ */+if (!function_exists('cubewp_elementor_post_card_preview_post_id')) {+	function cubewp_elementor_post_card_preview_post_id($preview_id)+	{+		$post_id = get_the_ID();+		$template_type = get_post_meta($post_id, 'template_type', true);+		if (get_post_type($post_id) == 'cubewp-tb' && $template_type == 'postcard') {+			$preview_post_id      = get_post_meta($post_id, 'preview_post_id', true);+			if ($preview_post_id) {+				return (int) $preview_post_id;+			} else {+				$template_location = get_post_meta($post_id, 'template_location', true);+				$associated_post_type = $template_location ? str_replace('postcard_', '', $template_location) : '';+				$args = array(+					'post_type'      => $associated_post_type,+					'posts_per_page' => 1,