themeum Vulnerabilities and Affected Products
Vulnerabilities associated with Qubely.
Products
Clear product- Tutor LMS – eLearning and online course solution37 vulnerabilities
- Tutor LMS19 vulnerabilities
- tutor_lms16 vulnerabilities
- Kirki – Freeform Page Builder, Website Builder & Customizer9 vulnerabilities
- Tutor LMS Pro9 vulnerabilities
- WP Crowdfunding9 vulnerabilities
- Kirki7 vulnerabilities
- Tutor LMS Elementor Addons6 vulnerabilities
- Qubely5 vulnerabilities
- Droip2 vulnerabilities
- Qubely – Advanced Gutenberg Blocks2 vulnerabilities
- Tutor LMS – Migration Tool2 vulnerabilities
- Right Way1 vulnerability
- Skillate1 vulnerability
- Tutor LMS BunnyNet Integration1 vulnerability
- tutor_lms_pro1 vulnerability
- tutorlms-migrationtool1 vulnerability
- WP Mega Menu1 vulnerability
- WP Page Builder (WordPress plugin)1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-65531MEDIUM | WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Qubely <= 1.8.14 versions. CWE-862Jul 23, 2026 | CVSS4.8v3.1 | EPSS0.144% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39638MEDIUM | WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14. CWE-79Apr 8, 2026 | CVSS5.9v3.1 | EPSS0.172% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-58249MEDIUM | WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure VulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14. CWE-201Sep 22, 2025 | CVSS4.3v3.1 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-58663MEDIUM | WordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityMissing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14. CWE-862Sep 22, 2025 | CVSS4.3v3.1 | EPSS0.22% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26767MEDIUM | WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12. CWE-79Feb 16, 2025 | CVSS6.5v3.1 | EPSS0.21% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |