CVE-2025-68559
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The TheGem Theme Elements (for Elementor) plugin by CodexThemes contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 5.10.5.1.
Risk Assessment
An attacker could inject malicious scripts that execute in a user's browser, potentially leading to session or data theft. WordPress sites using the vulnerable plugin are at risk.
Recommendation
Update TheGem Theme Elements (for Elementor) plugin to a version later than 5.10.5.1. Verify sites for potential XSS vectors.
Other vulnerabilities in TheGem Theme Elements (for Elementor)
See all- CVE-2026-42410Medium
CodexThemes TheGem Theme Elements (for Elementor) contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability allowing DOM-Based XSS. This affects versions before 5.12.1.1.
- CVE-2025-69357Medium
The TheGem Theme Elements plugin (for Elementor) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS