Search criteria
6 vulnerabilities found for Qubely – Advanced Gutenberg Blocks by Themeum
CVE-2024-13228 (GCVE-0-2024-13228)
Vulnerability from cvelistv5 – Published: 2025-03-11 07:05 – Updated: 2025-03-11 15:54
VLAI?
Title
Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content
Summary
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.
Severity ?
4.3 (Medium)
CWE
- CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| themeum | Qubely – Advanced Gutenberg Blocks |
Affected:
* , ≤ 1.8.13
(semver)
|
Credits
Nirmal
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-11T15:47:34.425283Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-11T15:54:12.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Qubely \u2013 Advanced Gutenberg Blocks",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "1.8.13",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nirmal"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Qubely \u2013 Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the \u0027qubely_get_content\u0027. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-359",
"description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-11T07:05:16.631Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/qubely/trunk/core/QUBELY.php#L1172"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3253223/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-10T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "Qubely \u2013 Advanced Gutenberg Blocks \u003c= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13228",
"datePublished": "2025-03-11T07:05:16.631Z",
"dateReserved": "2025-01-08T20:52:26.234Z",
"dateUpdated": "2025-03-11T15:54:12.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-26767 (GCVE-0-2025-26767)
Vulnerability from cvelistv5 – Published: 2025-02-16 22:17 – Updated: 2025-02-18 19:33
VLAI?
Title
WordPress Qubely – Advanced Gutenberg Blocks plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely – Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely – Advanced Gutenberg Blocks: from n/a through 1.8.12.
Severity ?
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Themeum | Qubely – Advanced Gutenberg Blocks |
Affected:
n/a , ≤ 1.8.12
(custom)
|
Credits
zaim (Patchstack Alliance)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T17:24:39.593901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T19:33:50.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "qubely",
"product": "Qubely \u2013 Advanced Gutenberg Blocks",
"vendor": "Themeum",
"versions": [
{
"changes": [
{
"at": "1.8.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.8.12",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "zaim (Patchstack Alliance)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Themeum Qubely \u2013 Advanced Gutenberg Blocks allows Stored XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Qubely \u2013 Advanced Gutenberg Blocks: from n/a through 1.8.12.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Themeum Qubely \u2013 Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely \u2013 Advanced Gutenberg Blocks: from n/a through 1.8.12."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-16T22:17:18.804Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/qubely/vulnerability/wordpress-qubely-advanced-gutenberg-blocks-plugin-1-8-12-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Qubely \u2013 Advanced Gutenberg Blocks wordpress plugin to the latest available version (at least 1.8.13)."
}
],
"value": "Update the WordPress Qubely \u2013 Advanced Gutenberg Blocks wordpress plugin to the latest available version (at least 1.8.13)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Qubely \u2013 Advanced Gutenberg Blocks plugin \u003c= 1.8.12 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-26767",
"datePublished": "2025-02-16T22:17:18.804Z",
"dateReserved": "2025-02-14T06:53:32.111Z",
"dateUpdated": "2025-02-18T19:33:50.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9601 (GCVE-0-2024-9601)
Vulnerability from cvelistv5 – Published: 2025-02-14 06:40 – Updated: 2025-02-14 14:39
VLAI?
Title
Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'
Summary
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| themeum | Qubely – Advanced Gutenberg Blocks |
Affected:
* , ≤ 1.8.12
(semver)
|
Credits
Nirmal
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T14:39:25.308332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T14:39:42.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Qubely \u2013 Advanced Gutenberg Blocks",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "1.8.12",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nirmal"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Qubely \u2013 Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018align\u2019 and \u0027UniqueID\u0027 parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T06:40:11.635Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/58387a60-ef68-4911-9349-97b0f7e7726f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/qubely/trunk/core/blocks/postgrid.php#L1419"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3235188/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-13T18:36:16.000+00:00",
"value": "Disclosed"
}
],
"title": "Qubely \u2013 Advanced Gutenberg Blocks \u003c= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027align\u0027 and \u0027UniqueID\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-9601",
"datePublished": "2025-02-14T06:40:11.635Z",
"dateReserved": "2024-10-07T19:27:28.196Z",
"dateUpdated": "2025-02-14T14:39:42.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13228 (GCVE-0-2024-13228)
Vulnerability from nvd – Published: 2025-03-11 07:05 – Updated: 2025-03-11 15:54
VLAI?
Title
Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content
Summary
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.
Severity ?
4.3 (Medium)
CWE
- CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| themeum | Qubely – Advanced Gutenberg Blocks |
Affected:
* , ≤ 1.8.13
(semver)
|
Credits
Nirmal
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-11T15:47:34.425283Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-11T15:54:12.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Qubely \u2013 Advanced Gutenberg Blocks",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "1.8.13",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nirmal"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Qubely \u2013 Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the \u0027qubely_get_content\u0027. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-359",
"description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-11T07:05:16.631Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/qubely/trunk/core/QUBELY.php#L1172"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3253223/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-10T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "Qubely \u2013 Advanced Gutenberg Blocks \u003c= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13228",
"datePublished": "2025-03-11T07:05:16.631Z",
"dateReserved": "2025-01-08T20:52:26.234Z",
"dateUpdated": "2025-03-11T15:54:12.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-26767 (GCVE-0-2025-26767)
Vulnerability from nvd – Published: 2025-02-16 22:17 – Updated: 2025-02-18 19:33
VLAI?
Title
WordPress Qubely – Advanced Gutenberg Blocks plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely – Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely – Advanced Gutenberg Blocks: from n/a through 1.8.12.
Severity ?
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Themeum | Qubely – Advanced Gutenberg Blocks |
Affected:
n/a , ≤ 1.8.12
(custom)
|
Credits
zaim (Patchstack Alliance)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T17:24:39.593901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T19:33:50.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "qubely",
"product": "Qubely \u2013 Advanced Gutenberg Blocks",
"vendor": "Themeum",
"versions": [
{
"changes": [
{
"at": "1.8.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.8.12",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "zaim (Patchstack Alliance)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Themeum Qubely \u2013 Advanced Gutenberg Blocks allows Stored XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Qubely \u2013 Advanced Gutenberg Blocks: from n/a through 1.8.12.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Themeum Qubely \u2013 Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely \u2013 Advanced Gutenberg Blocks: from n/a through 1.8.12."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-16T22:17:18.804Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/qubely/vulnerability/wordpress-qubely-advanced-gutenberg-blocks-plugin-1-8-12-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Qubely \u2013 Advanced Gutenberg Blocks wordpress plugin to the latest available version (at least 1.8.13)."
}
],
"value": "Update the WordPress Qubely \u2013 Advanced Gutenberg Blocks wordpress plugin to the latest available version (at least 1.8.13)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Qubely \u2013 Advanced Gutenberg Blocks plugin \u003c= 1.8.12 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-26767",
"datePublished": "2025-02-16T22:17:18.804Z",
"dateReserved": "2025-02-14T06:53:32.111Z",
"dateUpdated": "2025-02-18T19:33:50.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9601 (GCVE-0-2024-9601)
Vulnerability from nvd – Published: 2025-02-14 06:40 – Updated: 2025-02-14 14:39
VLAI?
Title
Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'
Summary
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| themeum | Qubely – Advanced Gutenberg Blocks |
Affected:
* , ≤ 1.8.12
(semver)
|
Credits
Nirmal
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T14:39:25.308332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T14:39:42.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Qubely \u2013 Advanced Gutenberg Blocks",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "1.8.12",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nirmal"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Qubely \u2013 Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018align\u2019 and \u0027UniqueID\u0027 parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T06:40:11.635Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/58387a60-ef68-4911-9349-97b0f7e7726f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/qubely/trunk/core/blocks/postgrid.php#L1419"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3235188/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-13T18:36:16.000+00:00",
"value": "Disclosed"
}
],
"title": "Qubely \u2013 Advanced Gutenberg Blocks \u003c= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027align\u0027 and \u0027UniqueID\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-9601",
"datePublished": "2025-02-14T06:40:11.635Z",
"dateReserved": "2024-10-07T19:27:28.196Z",
"dateUpdated": "2025-02-14T14:39:42.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}