CVE-2025-62012

MediumCVSS 6.5

Published: 06/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The TheGem (Elementor) plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.

Risk Assessment

The risk involves the possibility of injecting malicious scripts, which could lead to data theft, session hijacking, or phishing attacks. The attack could be used to display fake content in the context of a trusted site.

Recommendation

It is recommended to update the TheGem (Elementor) plugin to the latest patched version. Also, apply proper input filtering and output encoding.

Other vulnerabilities in TheGem (Elementor)

CVE-2025-60096Medium
The TheGem (Elementor) plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS