What is the CVSS score of CVE-2026-9714?

CVE-2026-9714 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Simple Divi Shortcode CVE-2026-9714

EUVD-2026-33252 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-29 Wordfence

GHSA-f3vv-fhm6-p4jh

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 06:44 vuln.today

CVE Published

May 29, 2026 - 05:32 nvd

MEDIUM 6.4

DescriptionCVE.org

The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and including, 1.2 This is due to insufficient input sanitization and output escaping in the showmodule_shortcode() function, which concatenates the 'id' shortcode attribute directly into a dynamically constructed shortcode string without applying esc_attr() or any escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Simple Divi Shortcode WordPress plugin (versions up to and including 1.2) allows authenticated attackers with contributor-level access to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'id' parameter of the [showmodule] shortcode. The injected payload executes in the browser of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or malicious redirects within the victim's authenticated session context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability exists in the showmodule_shortcode() function within simple_divi_shortcode.php (line 62-63), developed by vendor creaweb2b (CPE: cpe:2.3:a:creaweb2b:simple_divi_shortcode:*:*:*:*:*:*:*:*). The function accepts shortcode attributes and concatenates the 'id' parameter directly into a dynamically constructed shortcode string without applying WordPress's esc_attr() sanitization function or any output escaping. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw: the absence of escaping allows an attacker to break out of the HTML attribute context using characters such as quotes, angle brackets, or event handler syntax. Because WordPress shortcodes are processed server-side and their rendered output is stored in post content, the malicious script is persisted in the database and served to every subsequent visitor - classifying this as stored (persistent) XSS rather than reflected.

RemediationAI

Upstream fix available via a Trac changeset from version 1.2 to 1.2.1 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-divi-shortcode/tags/1.2&new_path=%2Fsimple-divi-shortcode/tags/1.2.1); a released patched version is referenced but not independently confirmed as pushed to the WordPress plugin repository - administrators should verify version 1.2.1 is available in the WordPress Plugin Directory and update immediately. If the update is not yet available in the plugin directory, a compensating control is to remove contributor-level posting capability from untrusted user roles using a capability manager plugin (e.g., Members or User Role Editor), preventing untrusted users from inserting shortcodes into posts - note this trade-off restricts legitimate contributor functionality. Alternatively, disable or remove the Simple Divi Shortcode plugin entirely if it is not essential to site operation. WordPress site administrators should also audit existing posts and pages for presence of [showmodule] shortcodes with suspicious 'id' parameter values to identify any prior injection attempts.