High-Severity Flaws in 'TheGem' WordPress Plugin Expose Sites to RFI and XSS Attacks
High-Severity Flaws in 'TheGem' WordPress Plugin Expose Sites to RFI and XSS Attacks
Full Report
Executive Summary
On December 23, 2025, two vulnerabilities were publicly disclosed in the TheGem Theme Elements plugin for Elementor, a popular tool for building WordPress websites. The flaws expose websites to significant risk. The first, CVE-2025-68560, is a high-severity Remote File Inclusion (RFI) vulnerability (CVSS 7.5) that could lead to full server compromise. The second, CVE-2025-68559, is a medium-severity Cross-Site Scripting (XSS) vulnerability (CVSS 6.5). All versions of the plugin up to and including 5.10.5.1 are affected. Website administrators are strongly advised to update the plugin to a patched version immediately to prevent potential exploitation.
Vulnerability Details
CVE-2025-68560: Remote File Inclusion (RFI)
- CVSS Score: 7.5 (High)
- Description: This vulnerability exists due to improper control of filenames used in
includeorrequirestatements within the plugin's PHP code. An attacker can manipulate input to cause the server to include and execute a PHP file hosted on a remote server. Successful exploitation typically leads to arbitrary code execution with the permissions of the web server process, resulting in a complete compromise of the website and potentially the underlying server.
CVE-2025-68559: Cross-Site Scripting (XSS)
- CVSS Score: 6.5 (Medium)
- Description: This flaw is a result of the plugin failing to properly sanitize user-supplied input before rendering it on a web page. An attacker can inject malicious JavaScript code into a vulnerable page. When a victim visits this page, the script executes in their browser, allowing the attacker to steal session cookies, deface the site, or redirect users to malicious websites.
Affected Systems
- Plugin: CodexThemes TheGem Theme Elements for Elementor
- Affected Versions: All versions up to and including 5.10.5.1
Technical Analysis
The RFI vulnerability (CVE-2025-68560) is the more critical of the two. It likely exists in a function that takes a user-supplied parameter (e.g., from a URL query string or POST body) and uses it directly in a PHP include() statement. An attacker could provide a URL to their own malicious PHP script (e.g., http://attacker.com/shell.txt) as the parameter value, causing the WordPress server to fetch and execute it.
The XSS vulnerability (CVE-2025-68559) is a classic stored or reflected XSS flaw where input is not properly escaped using functions like htmlspecialchars() before being displayed to the user.
MITRE ATT&CK TTPs
- Initial Access:
T1190 - Exploit Public-Facing Application(for CVE-2025-68560) - Execution:
T1059.007 - JavaScript(for CVE-2025-68559) - Execution:
T1059.005 - Visual Basic(if PHP webshell is used) - Persistence:
T1505.003 - Web Shell(A common outcome of RFI exploitation)
Impact Assessment
Exploitation of CVE-2025-68560 can lead to a full website takeover. Attackers can steal sensitive data from the website's database (including user credentials), deface the site, inject malware to attack visitors (drive-by downloads), or use the compromised server to send spam or participate in DDoS attacks. The impact is severe.
Exploitation of CVE-2025-68559 primarily affects the website's users. It can lead to account takeover for logged-in users (including administrators) if session cookies are stolen, compromising the integrity of the site.
Cyber Observables for Detection
url_pattern?file=http:// or ?file=//url_pattern<script>, alert(), onerror=file_name*.php in upload directories/wp-content/uploads/ can be a sign of a webshell.network_traffic_patternDetection & Response
- Web Application Firewall (WAF): Implement a WAF with rulesets designed to block common RFI and XSS attack patterns. This can provide a layer of protection against exploitation attempts. This is a form of
D3-ITF: Inbound Traffic Filtering. - Log Analysis: Regularly review web server access logs and WAF logs for the observable patterns listed above. A spike in HTTP 404 or 500 errors can also indicate failed exploit attempts.
- File Integrity Monitoring (FIM): Use a FIM tool to monitor your WordPress installation for unexpected file changes or the appearance of new PHP files, which could indicate a successful webshell upload.
Mitigation
- Update Immediately: The primary and most effective mitigation is to update TheGem Theme Elements plugin to the latest patched version (greater than 5.10.5.1) through the WordPress dashboard. This is an application of
D3-SU: Software Update. - Disable Plugin (Temporary): If you cannot update immediately, disable and delete the plugin as a temporary measure to remove the attack surface. This will likely break your site's functionality, so it should only be a last resort.
- Harden PHP Configuration: To mitigate RFI risks in general, ensure your server's
php.inifile hasallow_url_fopenandallow_url_includeset toOff. This prevents PHP from fetching remote files viainclude/requirestatements, breaking most RFI exploits. This is a key part ofD3-PH: Platform Hardening. - Regular Backups: Maintain regular, automated backups of your website files and database. In the event of a compromise, a clean backup is the fastest way to restore your site.
Timeline of Events
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.