CVE-2026-65480
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious scripts in the victim's browser, potentially leading to data theft, session hijacking, or content manipulation.
Recommendation
Update the TheGem theme to version 5.12.1.1 or later, which includes the fix. Additionally, consider implementing a Content Security Policy (CSP) to mitigate the risk.
Other vulnerabilities in TheGem
See all- CVE-2026-66609Critical
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
- CVE-2025-62011Medium
The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.
- CVE-2025-60097Medium
The TheGem plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS