DiviGear Carousel CVE-2026-93878

Requires an authenticated WordPress account at subscriber level or above on the target site (PR:L), and the ability to invoke the plugin's update_license AJAX action. The stored payload only fires when an administrator subsequently navigates to the DiviGear > Activation settings page, where the value is echoed unescaped into a single-quoted HTML value attribute - so exploitation is gated on that specific admin action occurring. Limiting factors: no unauthenticated access, affected only on DiviGear Carousel versions ≤5.2.0, and impact is confined to whoever views the Activation page (realistically an administrator).

This is a moderate-risk authenticated Stored XSS (CWE-79) in the niche DiviGear Carousel WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) confirms network vector, low complexity, and - critically - PR:L, meaning exploitation requires an authenticated account at subscriber level or above, so this is NOT unauthenticated. The scope change (S:C) reflects that the injected script executes in the administrator's browser context, enabling privilege escalation beyond the low-privileged attacker's own account. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input; per the data, there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is therefore meaningfully lower than the 'network, low-complexity' metrics alone suggest: the attack needs a pre-existing low-privilege account on the target site AND an administrator to subsequently visit the DiviGear > Activation page. Treat as a genuine but non-emergency patch priority, weighted down by the plugin's limited deployment footprint and the authentication prerequisite. Note: the only references provided are the vendor homepage and the Wordfence threat-intel entry - affected-version and fix data were not independently cross-verified from a vendor changelog.

A low-privileged user (subscriber or above) on a WordPress site running DiviGear Carousel ≤5.2.0 sends a crafted update_license AJAX request containing a malicious script payload, which is stored without sanitization. When an administrator later opens the DiviGear > Activation settings page, the unescaped value is echoed into a single-quoted HTML attribute and the script executes in the admin's authenticated session, enabling session/account takeover actions. No public exploit code was identified in the provided data.