TheGem Theme Elements (for Elementor) contains an improper neutralization of input during web page generation, allowing an attacker to inject malicious JavaScript that is stored and later delivered to other users. This stored XSS flaw can compromise the confidentiality and integrity of website users’ data, potentially leading to session hijacking or credential theft. The weakness is classified as CWE‑79.

CodexThemes’ TheGem Theme Elements for Elementor plugin is affected. All installations running version 5.11.0 or earlier are vulnerable; newer releases are not listed further in the CVE data.

The CVSS v3 score of 6.5 indicates a moderate severity, while the EPSS score indicates the likelihood of exploitation is below 1% and the vulnerability is not in the CISA KEV catalog. Attackers would need to supply a crafted input that the plugin accepts and later displays; the path is likely via the plugin’s element editing interface, although the exact vector is not explicitly detailed in the disclosure and is therefore inferred from the stored XSS nature of the flaw.