CVE-2025-62044

MediumCVSS 6.5

Published: 06/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements. This issue affects TheGem Theme Elements (for WPBakery) from n/a through <= 5.10.5.1.

Risk Assessment

The risk is the possibility of injecting malicious scripts, which could lead to data theft, session hijacking, or other attacks on users.

Recommendation

It is recommended to update the theme to a version newer than 5.10.5.1 and check for any XSS attacks.

Other vulnerabilities in TheGem Theme Elements

CVE-2026-57804High
The TheGem Theme Elements (for Elementor) plugin by CodexThemes contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement. The issue affects versions before 5.12.1.1.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS