Supreme Modules Lite
Monthly
Author-level cross-site scripting (XSS) in the Supreme Modules Lite (Supreme Modules for Divi) WordPress plugin affects all versions up to and including 2.5.63, allowing a user holding content-authoring privileges to store a script payload through the plugin's Divi module fields. When a higher-privileged user - typically an administrator - later loads the affected page or module, the injected JavaScript executes in their session context (CVSS 5.9, AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L; our assessment lowers the privilege bar to PR:L based on the 'Author' wording). Real-world risk is modest: exploitation demands a pre-existing account with at least Author-level rights, depends on both the plugin and the underlying Divi theme/builder being installed and active, and requires victim interaction, so no public exploit code has been identified at time of analysis. No entry exists in CISA KEV and no EPSS enrichment was supplied.
Author-level cross-site scripting (XSS) in the Supreme Modules Lite (Supreme Modules for Divi) WordPress plugin affects all versions up to and including 2.5.63, allowing a user holding content-authoring privileges to store a script payload through the plugin's Divi module fields. When a higher-privileged user - typically an administrator - later loads the affected page or module, the injected JavaScript executes in their session context (CVSS 5.9, AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L; our assessment lowers the privilege bar to PR:L based on the 'Author' wording). Real-world risk is modest: exploitation demands a pre-existing account with at least Author-level rights, depends on both the plugin and the underlying Divi theme/builder being installed and active, and requires victim interaction, so no public exploit code has been identified at time of analysis. No entry exists in CISA KEV and no EPSS enrichment was supplied.