GCVE - cpe:2.3:a:codexthemes:thegem:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:codexthemes:thegem:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Codexthemes (`6f7d456b-e954-5f3b-bbc5-200666328d2e`)
Product	Thegem (`6ad73899-590f-5084-a702-449158a37fba`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-62011`	vulnerable	2026-06-08 07:37:28.534465	WordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from n/a through <= 5.10.5. Published: 2025-11-06T15:55:22.593Z Updated: 2026-04-28T18:46:55.151Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/thegem/vulnerability/wordpress-thegem-theme-5-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-60097`	vulnerable	2026-06-08 07:37:26.620784	WordPress TheGem Theme <= 5.10.5 - Broken Access Control Vulnerability MEDIUM (5.4) Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5. Published: 2025-09-26T08:31:19.515Z Updated: 2026-04-28T16:13:54.743Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/thegem/vulnerability/wordpress-thegem-theme-5-10-5-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-4339`	vulnerable	2026-06-08 07:29:16.056909	TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update MEDIUM (4.3) The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary theme options. Published: 2025-05-13T06:40:56.275Z Updated: 2026-04-08T17:32:36.442Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/f2358979-25b9-4c52-88dc-25390be6bd22?source=cve https://themeforest.net/item/thegem-creative-multipurpose-highperformance-wordpress-theme/16061685 https://codex-themes.com/thegem/changelog.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-4317`	vulnerable	2026-06-08 07:29:16.028906	TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload HIGH (8.8) The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegem_get_logo_url() function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Published: 2025-05-13T06:40:55.865Z Updated: 2026-04-08T17:25:37.340Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/d379bc09-7788-4a29-b23f-7f42afe04fd4?source=cve https://themeforest.net/item/thegem-creative-multipurpose-highperformance-wordpress-theme/16061685 https://codex-themes.com/thegem/changelog.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.