CVE Catalog
CVE-2026-39638
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
The Qubely plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
Risk Assessment
Risk of session theft, defacement, or theft of sensitive data from users visiting the infected page.
Recommendation
Update the Qubely plugin to version 1.8.15 or later.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.