TI-2018-15332 Aliases CVE-2018-25106 GHSA-69f7-q9jg-9r54

webuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injection

LOW 24CWE-74Published 2024-12-23 · Updated 2024-12-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00359 29th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
webuidesigning	NebulaX Theme	5.0	—	No fix listed	CNA

NebulaX Theme Vendorwebuidesigning Affected 5.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-25106
2026-10-03 Alias added: GHSA-69f7-q9jg-9r54

References

Patch 1

https://github.com/webuidesigning/NebulaX/commit/41230a81db0f671c570c2644bc2f80565ca83c5a

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences