Themeum

Qubely

9 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.9

CVE-2026-39638

  • EPSS 0.03%
  • Veröffentlicht 08.04.2026 08:30:31
  • Zuletzt bearbeitet 13.04.2026 20:16:38

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.

4.3

CVE-2025-58249

  • EPSS 0.03%
  • Veröffentlicht 22.09.2025 18:23:30
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14.

4.3

CVE-2025-58663

  • EPSS 0.02%
  • Veröffentlicht 22.09.2025 18:22:59
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14.

6.5

CVE-2024-13228

  • EPSS 0.17%
  • Veröffentlicht 11.03.2025 07:05:16
  • Zuletzt bearbeitet 26.05.2025 02:31:47

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributo...

5.4

CVE-2025-26767

  • EPSS 0.11%
  • Veröffentlicht 16.02.2025 23:15:11
  • Zuletzt bearbeitet 01.04.2026 17:18:44

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12.

5.4

CVE-2024-9601

  • EPSS 0.21%
  • Veröffentlicht 14.02.2025 07:15:32
  • Zuletzt bearbeitet 08.04.2026 18:22:56

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping...

5.4

CVE-2023-0376

Exploit
  • EPSS 0.23%
  • Veröffentlicht 16.01.2024 16:15:10
  • Zuletzt bearbeitet 02.06.2025 15:15:21

The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-S...

7.5

CVE-2021-24916

Exploit
  • EPSS 3.28%
  • Veröffentlicht 07.08.2023 15:15:10
  • Zuletzt bearbeitet 21.11.2024 05:54:00

The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.

6.5

CVE-2021-25013

Exploit
  • EPSS 0.12%
  • Veröffentlicht 24.01.2022 08:15:09
  • Zuletzt bearbeitet 21.11.2024 05:54:11

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as sub...