Read the docs

themeum

Records172All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high48CVSS 7.0–8.9

Exploited now

themeum records in CISA KEV

No themeum vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tutor Lms 49 records HIGH Wp Crowdfunding 11 records MEDIUM Qubely 6 records HIGH Droip 4 records MEDIUM Tutor Lms Elementor Addons 4 records LOW Wp Page Builder 4 records MEDIUM Tutor Lms - Migration Tool 2 records LOW

Records

6 records in Qubely · all components

TI-2021-07196 CVE-2021-24916 · GHSA-w9rc-g9q5-4rpr

Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending

Priority HIGH 72

The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01715 Published 2023-08-07 Fixed in 1.8.6
TI-2023-00360 CVE-2023-0376 · GHSA-hvw8-m5g6-cxrv

Qubely < 1.8.5 - Contributor+ Stored XSS

Priority MEDIUM 58

The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and a…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00745 Published 2024-01-16 Fixed in 1.8.5 CWE-79
TI-2024-08908 CVE-2024-9601 · GHSA-84p2-qp33-qgfg

Cross-site scripting in themeum Qubely – Advanced Gutenberg Blocks

Priority LOW 29

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input san…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00325 Published 2025-02-14 No fix listed CWE-79
TI-2021-07291 CVE-2021-25013 · GHSA-chxc-687f-jrfg

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

Priority LOW 29

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any au…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00429 Published 2022-01-24 Fixed in 1.7.8 CWE-862
TI-2025-19683 CVE-2025-26767 · GHSA-4rqp-q2jf-gm6h

WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00218 Published 2025-02-16 No fix listed CWE-79
Open these records in search →