The Gem theme contains a cross‑site scripting flaw that allows a contributor to inject arbitrary JavaScript into the site. The injected code executes in the browsers of users who view pages edited by the contributor, giving the attacker the ability to run client‑side scripts on the site.

WordPress sites that utilize the CodexThemes:TheGem theme version 5.11.1 or earlier. Any site still running that theme version is vulnerable regardless of other security settings, including the presence of additional plugins or hardening measures.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to obtain or compromise a contributor account to inject malicious script, implying the attack vector is the WordPress contributor interface and is restricted to users with that role. The vulnerability is a typical script injection weakness identified as CWE-79.