TheGem vulnerabilities

Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.

The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.

The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.

The TheGem plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.