medium5.4
CVE-2026-13712
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allow…
Impact
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
Affected products
| Product | Affected versions |
|---|---|
| Divi WordPress Theme | before 5.9.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.