CVE-2025-58663
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Qubely plugin for WordPress has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 1.8.14.
Risk Assessment
An attacker may gain access to functions intended only for authorized users, potentially leading to unauthorized changes or data leakage.
Recommendation
Update the Qubely plugin to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Qubely
See all- CVE-2026-65531Medium
The Qubely plugin for WordPress up to version 1.8.14 contains an Unauthenticated Broken Access Control vulnerability.
- CVE-2026-39638Medium
The Qubely plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2025-58249Medium
The Qubely plugin (versions up to and including 1.8.14) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
Original NVD description (English source)
Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS