CVE-2026-13712
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
- State
- Published
- Severity
- 5.4 Medium
- Published
- Aug 16, 2026
- Updated
- Aug 17, 2026
- Reserved
- Jun 29, 2026
Description
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
DiviUnknown |
|
References
- https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.