EUVD-2026-48091
GHSA-cqc8-hg5f-f2hq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor role requires PR:L; victim must view content for UI:R; scope changes to victim browser, but standard stored XSS carries no substantiated availability impact, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.
AnalysisAI
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
Technical ContextAI
TheGem is a commercial multipurpose WordPress theme developed by CodexThemes (CPE: cpe:2.3:a:codexthemes:thegem:*:*:*:*:*:*:*:*). The root cause is CWE-79 - Improper Neutralization of Input During Web Page Generation - meaning user-supplied input accepted from Contributor-role users is not adequately sanitized or HTML-encoded before being rendered in theme output. In the WordPress permission model, Contributors can create and submit posts but cannot publish directly; however, if theme-specific fields, shortcodes, or metadata accept raw HTML from this role without escaping, a stored XSS payload persists in the database and fires when an editor or administrator renders the page. The scope change in the CVSS vector (S:C) confirms execution occurs in a security context different from where the payload was inserted, characteristic of stored XSS affecting other authenticated users.
RemediationAI
Update TheGem to the first version released after 5.11.1 from the CodexThemes official source or WordPress theme repository; the exact patched version is not confirmed in the available intelligence data, so verify the current release against the Patchstack advisory at https://patchstack.com/database/wordpress/theme/thegem/vulnerability/wordpress-thegem-theme-5-11-1-cross-site-scripting-xss-vulnerability before updating. As an interim compensating control, audit and restrict Contributor-role assignments to only fully trusted internal users, removing that role from any external, guest, or community-registered accounts - this eliminates the required attacker foothold without affecting site functionality. A WAF rule targeting XSS patterns in POST body parameters can reduce exposure but may block legitimate rich-content submission from contributors. Pending the patch, administrators should manually review all Contributor-submitted content before publication.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today