TheGem vulnerabilities

3 known CVE vulnerabilities in TheGem, translated and rated.

CVE-2026-66609Critical
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
CVE-2026-65480Medium
The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.
CVE-2025-62011Medium
The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS