EUVD-2026-59909
GHSA-9jgc-73v6-9c3h
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS via network-accessible POST, low contributor privilege required, admin must view post (UI:R), scope changes to admin context; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
AnalysisAI
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role user to inject persistent JavaScript into the Social Media Follow module's link attributes, which executes in the browser of any higher-privileged user - including administrators - who subsequently views the affected post. A publicly available proof-of-concept exploit exists per WPScan, and the scope-changed CVSS vector (S:C) confirms the injected script runs in the victim's privileged session context rather than the attacker's. Vendor-released patch version 5.9.0 is available and should be applied immediately.
Technical ContextAI
Divi is a premium WordPress page-builder theme developed by Elegant Themes, identified in the CPE data as cpe:2.3:a:unknown:divi:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant: the Social Media Follow module allows contributors to configure social link URLs or related attributes, and these values are rendered into HTML link attributes (e.g., href or data attributes) without adequate output encoding or escaping. Because the payload persists in the WordPress database and is rendered server-side on every page load, it executes automatically for any privileged user who views the post, without requiring further attacker interaction. The CVSS scope metric S:C reflects that the injected script runs within the administrator's browser security context, giving it access to session cookies, the WordPress admin API, and any browser-stored credentials.
RemediationAI
The primary fix is to upgrade Divi to version 5.9.0 or later, which resolves the improper output escaping in the Social Media Follow module's link attribute rendering; the vendor-released patch is confirmed available. Advisory details are published by WPScan at https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/ and indexed at https://nvd.nist.gov/vuln/detail/CVE-2026-13712. If immediate upgrade is not possible, a targeted compensating control is to revoke or eliminate contributor-level roles for any untrusted or external users, effectively eliminating the attacker's prerequisite access; this has the trade-off of restricting legitimate editorial workflows. A secondary workaround is to disable or restrict the Social Media Follow module via Divi's module manager if that capability is available in the installed version, reducing the attack surface without full role changes. Generic WAF rules blocking script injection in POST bodies may provide partial mitigation but are unreliable against stored XSS in JSON-encoded module settings.
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inje
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 d
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all
Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Con
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Con
Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contrib
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today