CVE-2026-66609
CriticalCVSS 9.3Summary
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
Risk Assessment
Risk of unauthorized access to data, modification or deletion, and potential administrator account takeover.
Recommendation
Update the TheGem theme to the latest version that includes the security fix.
Other vulnerabilities in TheGem
See all- CVE-2026-65480Medium
The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.
- CVE-2025-62011Medium
The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.
- CVE-2025-60097Medium
The TheGem plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.
Original NVD description (English source)
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS