This vulnerability in Themeum Qubely (<= 1.8.14) involves the insertion of sensitive information into data sent by the plugin, which may allow an attacker with low privileges to retrieve embedded sensitive data. The CVSS 3.1 score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited impact on confidentiality only. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with low privileges can potentially retrieve sensitive information embedded in data sent by the Qubely plugin, which could lead to partial confidentiality loss. There is no impact on data integrity or availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access privileges to trusted users and monitor for suspicious activity related to the plugin's data handling.