CVE-2025-62011
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.
Risk Assessment
The risk involves the possibility of injecting malicious scripts, which could lead to data theft, session hijacking, or phishing attacks. The attack could be used to display fake content in the context of a trusted site.
Recommendation
It is recommended to update the TheGem plugin to the latest patched version. Also, apply proper input filtering and output encoding.
Other vulnerabilities in TheGem
See all- CVE-2026-66609Critical
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
- CVE-2026-65480Medium
The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from n/a through <= 5.10.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS