WordPress security by component
TheGem Theme Elements (for Elementor)
Plugin description
TheGem Theme Elements (for Elementor) is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 7.5.
Plugin slug:
thegem-elements-elementorLatest vulnerability
CVE-2026-57804: TheGem Theme Elements (for Elementor): Filesystem traversal
TheGem Theme Elements (for Elementor) is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 5.11.1.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57804
TheGem Theme Elements (for Elementor): Filesystem traversal
TheGem Theme Elements (for Elementor) is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 5.11.1.
|
> 5.11.1 |
CVE7.5
NVDPending
|
| Apr 27, 2026 |
CVE-2026-42410
TheGem Theme Elements (for Elementor): Cross-site scripting
TheGem Theme Elements (for Elementor) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a to < 5.12.1.1.
|
5.12.1.1 |
CVE6.5
NVDPending
|
| Jan 06, 2026 |
CVE-2025-69357
TheGem Theme Elements (for Elementor): Cross-site scripting
TheGem Theme Elements (for Elementor) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jan 06, 2026 |
CVE-2025-69356
TheGem Theme Elements (for Elementor): Filesystem traversal
TheGem Theme Elements (for Elementor) is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 23, 2025 |
CVE-2025-68560
TheGem Theme Elements (for Elementor): A security weakness
TheGem Theme Elements (for Elementor) is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 23, 2025 |
CVE-2025-68559
TheGem Theme Elements (for Elementor): Cross-site scripting
TheGem Theme Elements (for Elementor) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|