CVE-2026-42410
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
CodexThemes TheGem Theme Elements (for Elementor) contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability allowing DOM-Based XSS. This affects versions before 5.12.1.1.
Risk Assessment
An attacker may execute malicious script in the browser of a user visiting a WordPress site with the vulnerable theme, potentially leading to session theft or other actions in the user's context.
Recommendation
Update TheGem Theme Elements (for Elementor) to version 5.12.1.1 or later.
Other vulnerabilities in TheGem Theme Elements (for Elementor)
See all- CVE-2025-69357Medium
The TheGem Theme Elements plugin (for Elementor) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
- CVE-2025-68559Medium
The TheGem Theme Elements (for Elementor) plugin by CodexThemes contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 5.10.5.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows DOM-Based XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS