CVE-2025-60097
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The TheGem plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.
Risk Assessment
An attacker could gain access to functionality that should be restricted, potentially leading to unauthorized changes or data exposure on the site.
Recommendation
Update the TheGem plugin to the latest version that fixes this vulnerability, or disable it if no update is available.
Other vulnerabilities in TheGem
See all- CVE-2026-66609Critical
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
- CVE-2026-65480Medium
The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.
- CVE-2025-62011Medium
The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.
Original NVD description (English source)
Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS