CVE-2021-24916: Themeum Qubely

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.

Affected products

• Themeum Qubely: before 1.8.6 (fixed in 1.8.6)

Published 2023-08-07. Last modified 2026-06-17.