The Gem theme contains a cross‑site scripting flaw that allows arbitrary JavaScript to be injected into web pages through unsanitized input during page generation. The injected code executes in the browsers of all users who view the affected pages, giving the attacker the ability to run client‑side scripts on the site.

WordPress sites that use the CodexThemes vendor’s TheGem theme version 5.12.1.1 or earlier. Any site still running that theme version is vulnerable regardless of other security settings, including the presence of additional plugins or hardening measures.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker could potentially exploit unsanitized input or editable content areas to inject malicious script; the exact access permissions or user role that would be required are not explicitly documented in the CVE, so the attack vector remains unspecified. The vulnerability follows the typical script injection pattern identified as CWE‑79.