WordPress TheGem plugin <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Theme TheGem versions = 5.10.3...

82,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in TheGem WordPress Theme

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On May 4th, 2025, we received a submission for an Arbitrary File Upload...

WordPress TheGem Theme <= 5.10.3 is vulnerable to Broken Access Control

Software TheGem Type Theme Vulnerable versions = 5.10.3 Fixed in 5.10.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-4339 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0df3139c7e52 Credits Foxyyy Required privilege Subscriber...

CVE-2023-32237

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem Elementor, CodexThemes TheGem WPBakery allows Stored XSS.This issue affects TheGem Elementor: from n/a before 5.8.1.1; TheGem WPBakery: from n/a before 5.8.1.1...

CVE-2023-32237 Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem Elementor, CodexThemes TheGem WPBakery allows Stored XSS.This issue affects TheGem Elementor: from n/a before 5.8.1.1; TheGem WPBakery: from n/a before 5.8.1.1...

CVE-2023-32237

CVE-2023-32237 describes a stored cross-site scripting (XSS) issue in the WordPress theme/plugin set TheGem. The root cause is improper neutralization of user input during web page generation, enabling stored XSS in TheGem (Elementor) and TheGem (WPBakery). Affected versions: TheGem for Elementor...

CVE-2023-32237 Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem Elementor, CodexThemes TheGem WPBakery allows Stored XSS.This issue affects TheGem Elementor: from n/a before 5.8.1.1; TheGem WPBakery: from n/a before 5.8.1.1...

WordPress Plugin TheGem 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin TheGem suffers from a...

TheGem < 5.9.2 - Reflected Cross-Site Scripting

Description The TheGem theme for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 5.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-50892

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9...

CVE-2023-50892

CVE-2023-50892 describes a Reflected XSS in TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme. Affected: TheGem versions up to 5.9.1 (range n/a–5.9.1). NVD lists CVSSv3.1 metrics: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N with base score 6.1 (Medium); Patchstack CNA reports CVSSv3.1 metrics...

CVE-2023-50892 WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9...

PT-2023-31706 · WordPress · Thegem

Name of the Vulnerable Software and Affected Versions: TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme versions n/a through 5.9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows...

WordPress Plugin TheGem Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)

Software TheGem Type Theme Vulnerable versions = 5.9.1 Fixed in 5.9.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50892 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e038c2e19876 Credits Rafie Muhammad Patchstack Required privile...

WordPress TheGem Theme < 5.8.1.1 is vulnerable to Broken Access Control

Software TheGem Type Theme Vulnerable versions 5.8.1.1 Fixed in 5.8.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32238 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dc2acc465d5c Credits Dave Jong Patchstack Required privile...

WordPress TheGem (Elementor) Theme < 5.8.1.1 is vulnerable to Broken Access Control

Software TheGem Elementor Type Theme Vulnerable versions 5.8.1.1 Fixed in 5.8.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32238 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0aabfb27ad22 Credits Dave Jong Patchstack Requir...

WordPress TheGem Theme < 5.8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software TheGem Type Theme Vulnerable versions 5.8.1.1 Fixed in 5.8.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32237 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 879b229258cd Credits Dave Jong Patchstack Required...

WordPress TheGem (Elementor) Theme < 5.8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software TheGem Elementor Type Theme Vulnerable versions 5.8.1.1 Fixed in 5.8.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32237 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 54db6f410b09 Credits Dave Jong Patchstack...