The Gem Theme Elements plugin contains a DOM‑based XSS flaw caused by inadequate input neutralization when generating web pages. An attacker can inject malicious JavaScript which then executes in the context of a visitor’s browser, allowing defacement, theft of credentials, or other client‑side attacks. The CVSS score of 6.5 classifies it as moderate severity, and the low EPSS value (<1%) indicates that, at the time of assessment, exploitation is unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog.

WordPress installations that use CodexThemes’ TheGem Theme Elements (for WPBakery) plugin up to and including version 5.11.0. Site administrators and users exposed to the plugin’s content are at risk.

The vulnerability can be triggered by loading a page that processes untrusted input from the plugin, typically via user‑submitted content or admin‑configurable elements. Exploitation requires that the victim view a crafted page, after which arbitrary code runs with the victim’s privileges. Given the moderate CVSS score and a very low EPSS, the immediate tactical risk is moderate, but the potential for social engineering attacks remains.