PT-2026-1487 · Codexthemes+1 · Thegem Theme Elements+1

Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-69360

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CodexThemes TheGem Theme Elements (for WPBakery) versions through 5.11.0

Description TheGem Theme Elements (for WPBakery) contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting (XSS) condition. This issue manifests as a DOM-Based XSS. The vulnerability allows for the injection of malicious scripts into web pages. The vulnerable component is susceptible to exploitation through crafted input.

Recommendations Update TheGem Theme Elements (for WPBakery) to a version later than 5.11.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-69360

Affected Products

Thegem Theme Elements

Wpbakery

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-69360 · Security Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/thegem-elements/vulnerability/wordpress-thegem-theme-elements-for-wpbakery-plugin-5-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/thegem-elements/vulnerability/wordpress-thegem-theme-elements-for-wpbakery-plugin-5-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/41513 · Telegram Post
• https://twitter.com/CVEnew/status/2008589646968606894 · Twitter Post