CVE-2025-58249
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Qubely plugin (versions up to and including 1.8.14) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
Risk Assessment
An attacker could read sensitive data embedded in sent responses, potentially leading to disclosure of confidential information.
Recommendation
Update the Qubely plugin to a version newer than 1.8.14 as soon as a fix is available. Until then, consider restricting site access or disabling the plugin.
Other vulnerabilities in Qubely
See all- CVE-2026-65531Medium
The Qubely plugin for WordPress up to version 1.8.14 contains an Unauthenticated Broken Access Control vulnerability.
- CVE-2026-39638Medium
The Qubely plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2025-58663Medium
The Qubely plugin for WordPress has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 1.8.14.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS