CVE-2026-42410
WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows DOM-Based XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.
| CWE | CWE-79 |
| Vendor | codexthemes |
| Product | thegem theme elements (for elementor) |
| Published | Apr 27, 2026 |
| Last Updated | Apr 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for codexthemes thegem theme elements (for elementor)
Be the first to know when new medium vulnerabilities affecting codexthemes thegem theme elements (for elementor) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
CodexThemes / TheGem Theme Elements (for Elementor)
n/a < 5.12.1.1
References
Credits
João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program