CVE-2026-65480 is a Cross-site Scripting (XSS) vulnerability in the TheGem theme, allowing DOM-Based XSS. The issue affects TheGem versions from n/a before 5.12.1.1. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. Users of TheGem theme versions prior to 5.12.1.1 should review and apply patches or updates to mitigate XSS attacks. Affected operators and security teams should assess pote [truncated]
CVE-2026-57804 is a PHP Local File Inclusion vulnerability in TheGem Theme Elements (for Elementor) due to improper control of filename for include/require statements. This issue affects TheGem Theme Elements (for Elementor) from n/a through <= 5.11.1 with a CVSS score of 7.5. The vulnerability allows attackers to include local files, potentially leading to code execution. Users of TheGem Theme Elements ( [truncated]
A Cross-site Scripting (XSS) vulnerability exists in TheGem Theme Elements (for WPBakery) plugin versions up to and including 5.11.0. This issue allows for DOM-Based XSS attacks. The vulnerability is caused by improper neutralization of input during web page generation. Defenders should assess exposure and prioritize verification and updates to prevent potential XSS attacks. The CVE record and NVD entry p [truncated]
A Cross-site Scripting (XSS) vulnerability exists in TheGem Theme Elements (for Elementor) plugin versions up to and including 5.11.0. This issue allows for Stored XSS, potentially enabling attackers to inject malicious scripts into web pages. The vulnerability has a CVSS score of 6.5 and is considered MEDIUM severity. Defenders and administrators of WordPress sites using TheGem Theme Elements (for Elemen [truncated]
A PHP Local File Inclusion vulnerability exists in TheGem Theme Elements (for Elementor) plugin versions up to and including 5.11.0. This issue allows for potential PHP Local File Inclusion attacks. The vulnerability arises from improper control of filename for include/require statements, which could enable attackers to include arbitrary files, potentially leading to code execution. Defenders should asses [truncated]
