The vulnerability arises from an improper neutralization of user‑supplied input during web page generation, allowing a stored cross‑site scripting flaw in the Qubely plugin. Because input is not sanitized, an attacker can inject JavaScript that executes in the browser of any visitor who loads a page that uses the plugin. This client‑side code execution can be leveraged for defacement, session hijacking, or theft of sensitive data accessed by the victim’s browser. The weakness is classified as CWE‑79.

All versions of the Themeum Qubely WordPress plugin from its initial release through version 1.8.14 are vulnerable. Any WordPress site that continues to host these plugin versions, regardless of content type or admin configuration, remains at risk.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active attacks are known. Based on the description, the likely attack vector requires an attacker to inject data into a field processed by the plugin or to have sufficient privileges to add content. If the site permits unauthenticated content creation, the risk increases, but the primary impact remains client‑side code execution.