CVE-2025-4339 TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update

The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary...

CVE-2025-4339 TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update

The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary...

CVE-2025-4339

CVE-2025-4339 (TheGem theme) : A missing capability check in TheGem’s ajaxApi() allows authenticated users with Subscriber+ permissions to update arbitrary theme options in all versions ≤ 5.10.3. Wordfence reports the vulnerability enabling data modification via the save action, with nonce protec...

CVE-2025-4317

TheGem WordPress theme (TheGem

CVE-2025-4317 TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

CVE-2025-4317 TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

CVE-2025-4339: Missing Authorization

The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary...

PT-2025-20836 · WordPress · Thegem

Name of the Vulnerable Software and Affected Versions: TheGem theme for WordPress versions up to and including 5.10.3 Description: The issue concerns unauthorized modification of data due to a missing capability check in the ajaxApi function. This allows authenticated attackers with...

CVE-2025-4317: Unrestricted Upload of File with Dangerous Type

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

WordPress TheGem Theme <= 5.10.3 is vulnerable to Broken Access Control

Software TheGem Type Theme Vulnerable versions = 5.10.3 Fixed in 5.10.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-4339 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0df3139c7e52 Credits Foxyyy Required privilege Subscriber...

CVE-2023-32237 Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem Elementor, CodexThemes TheGem WPBakery allows Stored XSS.This issue affects TheGem Elementor: from n/a before 5.8.1.1; TheGem WPBakery: from n/a before 5.8.1.1...

CVE-2023-32237 Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem Elementor, CodexThemes TheGem WPBakery allows Stored XSS.This issue affects TheGem Elementor: from n/a before 5.8.1.1; TheGem WPBakery: from n/a before 5.8.1.1...

CVE-2023-50892 WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9...

PT-2023-31706 · WordPress · Thegem

Name of the Vulnerable Software and Affected Versions: TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme versions n/a through 5.9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows...

WordPress TheGem Theme < 5.8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software TheGem Type Theme Vulnerable versions 5.8.1.1 Fixed in 5.8.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32237 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 879b229258cd Credits Dave Jong Patchstack Required...