This vulnerability in CodexThemes TheGem involves improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It specifically allows DOM-based XSS attacks, which can lead to partial confidentiality, integrity, and availability impacts. The affected versions are all versions up to and including 5.11.1. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, low privileges, user interaction, and results in a scope change with low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS score of 6.5 reflects a medium severity with limited but meaningful impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by CodexThemes or monitor for updates. Avoid exposing the vulnerable versions in untrusted environments and limit user privileges where possible.