Analysis Report · Folder Analysis cache/cubewp-framework_1.1.26 → cache/cubewp-framework_1.1.27 — CVE-2025-8615

--- cache/cubewp-framework_1.1.26/cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php	2026-01-18 00:19:20.627838824 +0000+++ cache/cubewp-framework_1.1.27/cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php	2026-01-18 00:21:29.799865377 +0000@@ -1,25 +1,28 @@ <?php-defined( 'ABSPATH' ) || exit;+defined('ABSPATH') || exit;  /**  * CubeWP Taxonomy Terms Shortcode.  *  * @class CubeWp_Frontend_Taxonomy_Shortcode  */-class CubeWp_Shortcode_Taxonomy {-	public function __construct() {-		add_shortcode( 'cubewp_shortcode_taxonomy', array( $this, 'cubewp_shortcode_taxonomy_callback' ) );-		add_filter( 'cubewp_shortcode_taxonomy_output', array( $this, 'cubewp_taxonomy_output' ), 10, 2 );+class CubeWp_Shortcode_Taxonomy+{+	public function __construct()+	{+		add_shortcode('cubewp_shortcode_taxonomy', array($this, 'cubewp_shortcode_taxonomy_callback'));+		add_filter('cubewp_shortcode_taxonomy_output', array($this, 'cubewp_taxonomy_output'), 10, 2); 	} -	public static function cubewp_taxonomy_output( $output, $parameters = array()) {-		if(empty($parameters) || count($parameters) == 0)-		return;+	public static function cubewp_taxonomy_output($output, $parameters = array())+	{+		if (empty($parameters) || count($parameters) == 0)+			return; -		wp_enqueue_style( 'cwp-taxonomy-shortcode' );+		wp_enqueue_style('cwp-taxonomy-shortcode'); 		$taxonomy        = isset($parameters['taxonomy']) ? $parameters['taxonomy'] : '';-		if(empty($taxonomy))-		return;+		if (empty($taxonomy))+			return;  		$terms_per_page  = $parameters['terms_per_page']; 		$output_style    = $parameters['output_style'];@@ -31,28 +34,28 @@ 		$child_terms     = false; 		$hide_empty      = false; 		$col_class       = '';-		if ( $_child_terms == 'yes' ) {+		if ($_child_terms == 'yes') { 			$child_terms = true; 		}-		if ( $_hide_empty == 'yes' ) {+		if ($_hide_empty == 'yes') { 			$hide_empty = true; 		}-		if ( $column_per_row == '0' ) {+		if ($column_per_row == '0') { 			$col_class = 'cwp-col-12 cwp-col-md-auto'; 		}-		if ( $column_per_row == '1' ) {+		if ($column_per_row == '1') { 			$col_class = 'cwp-col-12'; 		}-		if ( $column_per_row == '2' ) {+		if ($column_per_row == '2') { 			$col_class = 'cwp-col-12 cwp-col-md-6'; 		}-		if ( $column_per_row == '3' ) {+		if ($column_per_row == '3') { 			$col_class = 'cwp-col-12 cwp-col-md-6 cwp-col-lg-4'; 		}-		if ( $column_per_row == '4' ) {+		if ($column_per_row == '4') { 			$col_class = 'cwp-col-12 cwp-col-md-6 cwp-col-lg-3'; 		}-		if ( $column_per_row == '6' ) {+		if ($column_per_row == '6') { 			$col_class = 'cwp-col-12 cwp-col-md-6 cwp-col-lg-2'; 		} 		$args  = array(@@ -61,148 +64,154 @@ 			'parent'     => 0, 			'number'     => $terms_per_page, 		);-		$terms = get_terms( $args );+		$terms = get_terms($args); 		ob_start();-		if ( ! empty( $terms ) && is_array( $terms ) ) {+		if (! empty($terms) && is_array($terms)) { 			$counter = 0;-			?>-            <div class="cwp-row">-				<?php foreach ( $terms as $term ) {+?>+			<div class="cwp-row">+				<?php foreach ($terms as $term) { 					$term_id   = $term->term_id; 					$term_name = $term->name;-					if ( $output_style == 'boxed_view' ) {-						$color_count = count( $terms_box_color );-						$icon_media  = get_term_meta( $term_id, $icon_media_name, true );-						$color       = $terms_box_color[ $counter ]['term_box_color'];-						$counter ++;-						if ( $counter >= $color_count ) {+					if ($output_style == 'boxed_view') {+						$color_count = count($terms_box_color);+						$icon_media  = get_term_meta($term_id, $icon_media_name, true);+						$color = isset($terms_box_color[$counter]['term_box_color'])+							? sanitize_hex_color($terms_box_color[$counter]['term_box_color'])+							: '#000000';+						$counter++;+						if ($counter >= $color_count) { 							$counter = 0; 						}-						?>-                        <div class="<?php echo esc_attr( $col_class ); ?>">-                            <div class="cwp-taxonomy-term-box">-                                <div class="cwp-taxonomy-term-box-heading"-                                     style="background-color: <?php echo esc_html( $color ); ?>">+				?>+						<div class="<?php echo esc_attr($col_class); ?>">+							<div class="cwp-taxonomy-term-box">+								<div class="cwp-taxonomy-term-box-heading"+									style="background-color: <?php echo esc_html($color); ?>"> 									<?php-									if ( ! is_array( $icon_media ) ) {-										if ( $icon_media != strip_tags( $icon_media ) ) {-										   echo cubewp_core_data( $icon_media );-										} else if ( is_numeric( $icon_media ) ) {-										   $icon_media = wp_get_attachment_url( $icon_media );-										   echo '<img src="' . esc_attr($icon_media) . '" alt="' . esc_attr($term_name) . '">+									if (! is_array($icon_media)) {+										if ($icon_media != strip_tags($icon_media)) {+											echo cubewp_core_data($icon_media);+										} else if (is_numeric($icon_media)) {+											$icon_media = wp_get_attachment_url($icon_media);+											echo '<img src="' . esc_url($icon_media) . '" alt="' . esc_attr($term_name) . '"> 																		<div class="cwp-taxonomy-term-box-heading-overlay" style="background-color: ' . esc_attr($color) . ';"></div>'; 										} else {-										   echo '<i class="' . esc_attr($icon_media) . '" aria-hidden="true"></i>';+											echo '<i class="' . esc_attr($icon_media) . '" aria-hidden="true"></i>'; 										}-									 }+									} 									?>-                                    <a href="<?php echo get_term_link( $term_id ) ?>"><?php echo esc_html( $term_name ); ?></a>-                                </div>+									<a href="<?php echo esc_url( get_term_link( $term_id ) ); ?>"><?php echo esc_html( $term_name ); ?></a>+								</div> 								<?php-								if ( $child_terms ) {+								if ($child_terms) { 									$term_child_args = array( 										'taxonomy'   => $taxonomy, 										'hide_empty' => $hide_empty, 										'parent'     => $term_id, 									);-									$term_childs     = get_terms( $term_child_args );-									if ( ! empty( $term_childs ) && is_array( $term_childs ) ) {-										?>-                                        <ul class="cwp-taxonomy-term-child-terms">+									$term_childs     = get_terms($term_child_args);+									if (! empty($term_childs) && is_array($term_childs)) {+								?>+										<ul class="cwp-taxonomy-term-child-terms"> 											<?php-											$child_terms_count = count( $term_childs );+											$child_terms_count = count($term_childs); 											$term_counter      = 1;-											foreach ( $term_childs as $term_child ) {+											foreach ($term_childs as $term_child) { 												$child_term_id   = $term_child->term_id; 												$child_term_name = $term_child->name;-												if ( $child_terms_count > 5 && 5 == $term_counter ) {-													?>-                                                    <li>-                                                        <a href="#"-                                                           class="cwp-taxonomy-term-child-terms-see-more"-                                                           data-more="<?php esc_html_e( "View More", "cubewp-framework" ); ?>"-                                                           data-less="<?php esc_html_e( "View Less", "cubewp-framework" ); ?>"><?php esc_html_e( "View More", "cubewp-framework" ); ?></a>-                                                    </li>-                                                    <ul class="cwp-taxonomy-term-child-terms-more">+												if ($child_terms_count > 5 && 5 == $term_counter) {+											?>+													<li>+														<a href="#"+															class="cwp-taxonomy-term-child-terms-see-more"+															data-more="<?php esc_html_e("View More", "cubewp-framework"); ?>"+															data-less="<?php esc_html_e("View Less", "cubewp-framework"); ?>"><?php esc_html_e("View More", "cubewp-framework"); ?></a>+													</li>+													<ul class="cwp-taxonomy-term-child-terms-more"> 													<?php 												}-												?>-                                                <li>-                                                    <a href="<?php echo get_term_link( $child_term_id ) ?>"><?php echo esc_html( $child_term_name ); ?></a>-                                                </li>-												<?php-												if ( $child_terms_count > 5 && $child_terms_count == $term_counter ) { 													?>-                                                    </ul>+													<li>+														<a href="<?php echo get_term_link($child_term_id) ?>"><?php echo esc_html($child_term_name); ?></a>+													</li> 													<?php+													if ($child_terms_count > 5 && $child_terms_count == $term_counter) {+													?>+													</ul>+											<?php+													}+													$term_counter++; 												}-												$term_counter ++;-											} 											?>-                                        </ul>-										<?php+										</ul>+								<?php 									} 								} 								?>-                            </div>-                        </div>-						<?php-					} else if ( $output_style == 'list_view' ) {-						?>-                        <div class="<?php esc_attr_e( $col_class ); ?>">-                            <div class="cwp-taxonomy-term-list">-                                <a href="<?php echo get_term_link( $term_id ) ?>"><?php echo esc_html( $term_name ); ?></a>+							</div>+						</div>+					<?php+					} else if ($output_style == 'list_view') {+					?>+						<div class="<?php esc_attr_e($col_class); ?>">+							<div class="cwp-taxonomy-term-list">+								<a href="<?php echo get_term_link($term_id) ?>"><?php echo esc_html($term_name); ?></a> 								<?php-								if ( $child_terms ) {+								if ($child_terms) { 									$term_child_args = array( 										'taxonomy'   => $taxonomy, 										'hide_empty' => $hide_empty, 										'parent'     => $term_id, 									);-									$term_childs     = get_terms( $term_child_args );-									if ( ! empty( $term_childs ) && is_array( $term_childs ) ) {-										?>-                                        <ul><?php-										foreach ( $term_childs as $term_child ) {-											$child_term_id   = $term_child->term_id;-											$child_term_name = $term_child->name;+									$term_childs     = get_terms($term_child_args);+									if (! empty($term_childs) && is_array($term_childs)) {+								?>+										<ul><?php+											foreach ($term_childs as $term_child) {+												$child_term_id   = $term_child->term_id;+												$child_term_name = $term_child->name; 											?>-                                            <li>-                                                <a href="<?php echo get_term_link( $child_term_id ) ?>"><?php echo esc_html( $child_term_name ); ?></a>-                                            </li>+												<li>+													<a href="<?php echo get_term_link($child_term_id) ?>"><?php echo esc_html($child_term_name); ?></a>+												</li> 											<?php+											}+											?>+										</ul><?php+											} 										}-										?>-                                        </ul><?php-									}-								}-								?>-                            </div>-                        </div>-						<?php+												?>+							</div>+						</div>+				<?php 					} 				} ?>-            </div>-			<?php+			</div>+<?php 		}  		return ob_get_clean(); 	} -	public static function init() {+	public static function init()+	{ 		$CubeWPClass = __CLASS__; 		new $CubeWPClass; 	} -	public function cubewp_shortcode_taxonomy_callback( $parameters ) {-		$title  = isset( $parameters['title'] ) ? $parameters['title'] : '';+	public function cubewp_shortcode_taxonomy_callback($parameters)+	{+		$title  = isset($parameters['title']) ? sanitize_text_field($parameters['title']) : ''; 		$output = '<div class="cwp-widget-shortcode">';-		if ( ! empty( $title ) ) {-			$output .= '<h2 class="cwp-widget-shortcode-heading">' . $title . '</h2>';++		if (! empty($title)) {+			$output .= '<h2 class="cwp-widget-shortcode-heading">' . esc_html($title) . '</h2>'; 		}-		$output .= apply_filters( 'cubewp_shortcode_taxonomy_output', '', $parameters );++		$output .= apply_filters('cubewp_shortcode_taxonomy_output', '', $parameters); 		$output .= '</div>';  		return $output; 	}-}\ No newline at end of file+}

I'll analyze this code diff for security fixes.

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php - Lines 77-79
Old Code:
```php
$color       = $terms_box_color[ $counter ]['term_box_color'];
```
Fixed Code:
```php
$color = isset($terms_box_color[$counter]['term_box_color'])
    ? sanitize_hex_color($terms_box_color[$counter]['term_box_color'])
    : '#000000';
```
Explanation:
The old code directly used user-provided color data without sanitization in inline styles. The fixed code adds `sanitize_hex_color()` to validate and sanitize hex color values before they're output in the `style` attribute, preventing XSS attacks through malicious color values.

---

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php - Line 97
Old Code:
```php
echo '<img src="' . esc_attr($icon_media) . '" alt="' . esc_attr($term_name) . '">
```
Fixed Code:
```php
echo '<img src="' . esc_url($icon_media) . '" alt="' . esc_attr($term_name) . '">
```
Explanation:
The old code used `esc_attr()` on the image URL, which only escapes HTML attributes. The fixed code uses `esc_url()` to properly sanitize URLs, preventing XSS attacks through malicious protocol handlers (e.g., `javascript:`) in the `src` attribute.

---

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php - Line 104
Old Code:
```php
<a href="<?php echo get_term_link( $term_id ) ?>"><?php echo esc_html( $term_name ); ?></a>
```
Fixed Code:
```php
<a href="<?php echo esc_url( get_term_link( $term_id ) ); ?>"><?php echo esc_html( $term_name ); ?></a>
```
Explanation:
The old code output the term link without URL escaping. The fixed code wraps `get_term_link()` with `esc_url()` to sanitize the URL, preventing XSS attacks through malicious URLs in the `href` attribute.

---

Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php - Line 217
Old Code:
```php
$title  = isset( $parameters['title'] ) ? $parameters['title'] : '';
```
Fixed Code:
```php
$title  = isset($parameters['title']) ? sanitize_text_field($parameters['title']) : '';
```
Explanation:
The old code used user-supplied title data without sanitization. The fixed code applies `sanitize_text_field()` to strip HTML tags and encode special characters, preventing XSS attacks.

---

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - cube/classes/shortcodes/class-cubewp-shortcode-taxonomy.php - Line 222
Old Code:
```php
$output .= '<h2 class="cwp-widget-shortcode-heading">' . $title . '</h2>';
```
Fixed Code:
```php
$output .= '<h2 class="cwp-widget-shortcode-heading">' . esc_html($title) . '</h2>';
```
Explanation:
The old code directly concatenated the title without HTML escaping. The fixed code uses `esc_html()` to escape HTML special characters, preventing XSS attacks through the title output.

The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and including, 1.1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.