Thegem
Monthly
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.