What’s Vulnerable › Vulnerabilities

CVE-2024-13228: Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-11 · updated 2026-06-17
• Weakness: CWE-359

Description

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.

Affected products

• Themeum Qubely: before 1.8.14 — fixed in 1.8.14

How to fix

Upgrade to a fixed version: Themeum Qubely 1.8.14. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/qubely/trunk/core/QUBELY.php#L1172
• https://plugins.trac.wordpress.org/changeset/3253223/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=cve

Get alerted when CVE-2024-13228 or the next vulnerability affects your stack