CVE-2026-65480

MediumCVSS 6.5

Published: 23/07/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.

Risk Assessment

An attacker can exploit this vulnerability to execute malicious scripts in the victim's browser, potentially leading to data theft, session hijacking, or content manipulation.

Recommendation

Update the TheGem theme to version 5.12.1.1 or later, which includes the fix. Additionally, consider implementing a Content Security Policy (CSP) to mitigate the risk.

Other vulnerabilities in TheGem

CVE-2026-66609Critical
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS