Themes Vulnerabilities

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

Description

The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

Proof of Concept

Affects Themes

Divi
Fixed in 5.9.0

References

CVE
CVE-2026-13712

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
*,.$n.,*Sico.eX
Submitter
*,.$n.,*Sico.eX
Verified
Yes
WPVDB ID
d3a37071-5fb1-4aa2-8f89-eb13c46f6126

Timeline

Publicly Published
2026-08-14 (about 2 days ago)
Added
2026-08-14 (about 1 day ago)
Last Updated
2026-08-14 (about 1 day ago)

Other

Published
Title
Published
2024-11-15
Title
Sticky Social Icons <= 1.2.1 - Admin+ Stored XSS
Published
2023-01-03
Title
PDF Viewer < 1.0.0 - Contributor+ Stored XSS via Shortcode
Published
2025-11-01
Title
Booking and Rental Manager < 2.5.4 - Unauthenticated Stored Cross-Site Scripting
Published
2024-06-11
Title
Events Addon for Elementor < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2024-03-25
Title
SEO Plugin by Squirrly SEO < 12.3.17 - Reflected Cross-Site Scripting