Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: themeum Component: Qubely Clear all filters
TI-2025-19683 CVE-2025-26767 · GHSA-4rqp-q2jf-gm6h

WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00218 Published 2025-02-16 No fix listed CWE-79
TI-2024-08908 CVE-2024-9601 · GHSA-84p2-qp33-qgfg

Cross-site scripting in themeum Qubely – Advanced Gutenberg Blocks

Priority LOW 29

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input san…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00325 Published 2025-02-14 No fix listed CWE-79
TI-2023-00360 CVE-2023-0376 · GHSA-hvw8-m5g6-cxrv

Qubely < 1.8.5 - Contributor+ Stored XSS

Priority MEDIUM 58

The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and a…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00745 Published 2024-01-16 Fixed in 1.8.5 CWE-79
TI-2021-07196 CVE-2021-24916 · GHSA-w9rc-g9q5-4rpr

Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending

Priority HIGH 72

The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01715 Published 2023-08-07 Fixed in 1.8.6
TI-2021-07291 CVE-2021-25013 · GHSA-chxc-687f-jrfg

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

Priority LOW 29

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any au…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00429 Published 2022-01-24 Fixed in 1.7.8 CWE-862