Vulnerabilities

TI-2026-47280 CVE-2026-66609 · GHSA-h6f6-6rqr-c7wx

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-08-20 No fix listed CWE-89

TI-2026-46650 CVE-2026-65480 · GHSA-cqc8-hg5f-f2hq

WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-07-23 Fixed in 5.12.1.1 CWE-79

TI-2026-41626 CVE-2026-57804 · GHSA-8929-hx95-2hwj

WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 Fixed in 5.12.1.1 CWE-98

TI-2026-30707 CVE-2026-42410 · GHSA-xvp9-96q2-hp9x

WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows DOM-Based XSS.This issue affects TheGem Theme Elements (for E…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00127 Published 2026-04-27 Fixed in 5.12.1.1 CWE-79

TI-2025-42803 CVE-2025-69360 · GHSA-3j6c-pw4r-rhxw

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00159 Published 2026-01-06 No fix listed CWE-79

TI-2025-42800 CVE-2025-69357 · GHSA-h9x4-jqx3-qc29

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGe…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00159 Published 2026-01-06 No fix listed CWE-79

TI-2025-42799 CVE-2025-69356 · GHSA-2934-gw32-fqg4

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File I…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0039 Published 2026-01-06 No fix listed CWE-98

TI-2023-15536 CVE-2023-32238 · GHSA-2844-9647-m4rw

WordPress TheGem theme < 5.8.1.1 - Broken Access Control vulnerability

LOW 30

Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.002 Published 2025-12-29 Fixed in 5.8.1.1 CWE-284

TI-2025-42080 CVE-2025-68559 · GHSA-qw23-2m77-3c29

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00159 Published 2025-12-23 No fix listed CWE-79

TI-2025-42081 CVE-2025-68560 · GHSA-q6wf-2534-r448

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheG…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00379 Published 2025-12-23 No fix listed CWE-98

TI-2025-38369 CVE-2025-62046 · GHSA-ff25-8qm5-3w37

WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerability

LOW 29

Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from n/a through <= 5.10.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00364 Published 2025-11-06 No fix listed CWE-862

TI-2025-38368 CVE-2025-62045 · GHSA-88wf-mfc7-5q93

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme El…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00537 Published 2025-11-06 No fix listed CWE-98

TI-2025-38367 CVE-2025-62044 · GHSA-gx3q-6pr6-g9q4

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBaker…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00268 Published 2025-11-06 No fix listed CWE-79

TI-2025-38364 CVE-2025-62041 · GHSA-j9gp-4v9p-jmv2

WordPress TheGem (Elementor) theme <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.003 Published 2025-11-06 No fix listed CWE-79

TI-2025-38335 CVE-2025-62012 · GHSA-q6gw-m89w-g24c

WordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0021 Published 2025-11-06 No fix listed CWE-79

TI-2025-38334 CVE-2025-62011 · GHSA-qq74-8wm9-89mh

WordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from n/a through <= 5.10.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0021 Published 2025-11-06 No fix listed CWE-79

TI-2025-37463 CVE-2025-60097 · GHSA-fj75-84q9-q35x

WordPress TheGem Theme <= 5.10.5 - Broken Access Control Vulnerability

LOW 24

Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00273 Published 2025-09-26 No fix listed CWE-862

TI-2025-37462 CVE-2025-60096 · GHSA-5mrg-8wjj-6h3p

WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control Vulnerability

LOW 24

Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00273 Published 2025-09-26 No fix listed CWE-862

TI-2025-03868 CVE-2025-4339 · GHSA-2qj3-8hcm-v7fh

TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update

LOW 20

The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions up to, and including, 5.10.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00425 Published 2025-05-13 No fix listed CWE-862

TI-2025-03846 CVE-2025-4317 · GHSA-w36c-pjh8-xh3c

TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegem_get_logo_url() function in all versions up to, and including, 5.10.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01184 Published 2025-05-13 No fix listed CWE-434

TI-2023-15535 CVE-2023-32237 · GHSA-m6h2-9w6w-xj46

Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes

LOW 24

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery) allows Stored XSS.This issue affects TheGem (Elementor):…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00357 Published 2024-03-26 Fixed in 5.8.1.1 CWE-79

TI-2023-27795 CVE-2023-50892 · GHSA-x7h2-7m2p-9qfc

WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheG…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00343 Published 2023-12-29 No fix listed CWE-79

Vulnerabilities

Filters