TheGem Theme Elements (for WPBakery) versions up to 5.10.5.1 suffer from an improper input neutralization vulnerability leading to cross-site scripting (XSS). This vulnerability allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability. The vulnerability is network exploitable and affects the web page generation process within the theme elements. No vendor advisory or patch information is currently available.

Successful exploitation could lead to limited confidentiality, integrity, and availability impacts due to script execution in the context of affected users. The attack requires user interaction and low privileges, limiting the scope but still posing a risk of session hijacking or other client-side attacks. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to trusted users and monitoring for suspicious activity related to the theme elements. Avoid enabling untrusted user input that could trigger the vulnerability.