Codexthemes
Monthly
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Local File Inclusion in the CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin (versions up to and including 5.11.1) lets an authenticated low-privileged attacker coerce the application into including arbitrary local PHP files, exposing sensitive files and potentially executing attacker-influenced code within the site context. Classified as CWE-98 (PHP Remote/Local File Inclusion) and reported by Patchstack, the flaw carries a CVSS 3.1 base score of 7.5 with high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and no active exploitation on record.
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
DOM-based cross-site scripting (XSS) in CodexThemes TheGem Theme Elements plugin for Elementor allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when user interaction occurs. The vulnerability affects versions before 5.12.1.1 and requires authenticated access and user interaction to exploit, limiting real-world risk compared to network-vector XSS but still enabling session hijacking, credential theft, or unauthorized admin actions on WordPress sites using this plugin.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Local File Inclusion in the CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin (versions up to and including 5.11.1) lets an authenticated low-privileged attacker coerce the application into including arbitrary local PHP files, exposing sensitive files and potentially executing attacker-influenced code within the site context. Classified as CWE-98 (PHP Remote/Local File Inclusion) and reported by Patchstack, the flaw carries a CVSS 3.1 base score of 7.5 with high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and no active exploitation on record.
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
DOM-based cross-site scripting (XSS) in CodexThemes TheGem Theme Elements plugin for Elementor allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when user interaction occurs. The vulnerability affects versions before 5.12.1.1 and requires authenticated access and user interaction to exploit, limiting real-world risk compared to network-vector XSS but still enabling session hijacking, credential theft, or unauthorized admin actions on WordPress sites using this plugin.