Qubely EUVD-2026-20296

Successful exploitation requires the attacker to possess WordPress administrator or editor-level privileges (PR:H) and the victim to view the page containing the injected payload (UI:R). No special plugin configuration or non-default settings are required-the vulnerability exists in the standard Qubely page builder interface used during normal page and post creation. The attacker must use authenticated access to the WordPress admin dashboard or editor to inject the XSS payload via Qubely's content blocks or page elements.

This vulnerability presents moderate but contained risk. The CVSS score of 5.9 (Medium) reflects high attack complexity due to authentication and user interaction requirements (PR:H, UI:R), which significantly restrict exploitation scope compared to unauthenticated network vectors. The EPSS score of 0.03% (8th percentile) indicates exploitation is extremely unlikely in practice despite public awareness, suggesting limited attacker interest or technical barriers. The stored XSS impact (C:L, I:L, A:L) is further constrained by scope change (S:C), meaning impact is limited to the confidentiality, integrity, and availability of the affected application itself, not other systems. Real-world risk depends on WordPress site exposure: high-traffic sites with multiple editors face elevated risk from insider threats, while private or low-traffic installations face minimal exploitation probability. This is a legitimate vulnerability requiring patching, but not an urgent emergency-response scenario.

An authenticated WordPress administrator or editor with malicious intent uses the Qubely page builder interface to inject JavaScript code (e.g., <script>steal_cookies()</script>) into a page element or block. The payload is stored in the WordPress database without sanitization. When other site users (including additional administrators) view the compromised page, the script executes in their browsers, potentially capturing session cookies, redirecting to phishing sites, or injecting advertisements. No public exploit code is required-the attack is manual and relies on the attacker's existing admin credentials and the victim's page view.