Improper neutralization of input during page generation in the CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin allows an attacker to inject malicious script that is executed in the victim’s browser. The result is DOM‑based XSS, giving the attacker the ability to run arbitrary JavaScript when the page is rendered. This can lead to client‑side code execution within the context of the site’s domain.

The vulnerability is present in all versions of TheGem Theme Elements (for Elementor) that precede version 5.12.1.1. Any WordPress site using an unpublished or older release of the plugin is therefore vulnerable.

The CVSS score of 6.5 reflects a moderate risk level. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not flagged in the CISA KEV catalog. The likely attack vector involves the injection of malicious input through the Elementor editor or via crafted URLs that render unsafe content, which is inferred from the description of the XSS flaw. Exploitation would require the victim to visit or interact with such rendered content; no privilege escalation is described.