CVE-2026-39638
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Qubely plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
Risk Assessment
Risk of session theft, defacement, or theft of sensitive data from users visiting the infected page.
Recommendation
Update the Qubely plugin to version 1.8.15 or later.
Other vulnerabilities in Qubely
See all- CVE-2026-65531Medium
The Qubely plugin for WordPress up to version 1.8.14 contains an Unauthenticated Broken Access Control vulnerability.
- CVE-2025-58663Medium
The Qubely plugin for WordPress has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 1.8.14.
- CVE-2025-58249Medium
The Qubely plugin (versions up to and including 1.8.14) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS