Improper neutralization of input during web page generation allows an attacker to store malicious JavaScript code in data fields managed by the Qubely plugin. When other visitors view pages that retrieve and render this stored content, the script executes in their browsers, potentially allowing the attacker to deface the page or exfiltrate data. Based on the description, it is inferred that the stored payload will run with the privileges of the user viewing the affected content.

WordPress sites that have installed Themeum Qubely version 1.8.12 or earlier are affected. Any site using the plugin within this version range stores user data that may carry unsanitized payloads, creating a risk for all visitors who view the compromised content.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. Its EPSS score is less than 1 %, suggesting a low likelihood of current exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is likely a web‑application based stored XSS where an attacker injects malicious code into a Qubely data field that is later rendered for other users.