CVE-2026-13712: Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13712?
CVE-2026-13712 has a risk rating of 52, indicating a moderate severity level.
How do I fix CVE-2026-13712?
To fix CVE-2026-13712, update the Divi WordPress theme to version 5.9.0 or later.
What types of attacks are possible due to CVE-2026-13712?
CVE-2026-13712 allows for stored XSS attacks via malicious JavaScript in Social Media Follow settings.
Who is affected by CVE-2026-13712?
Users with the contributor role and higher privileges like administrators are affected by CVE-2026-13712.
What is the impact of CVE-2026-13712?
The impact of CVE-2026-13712 includes the potential execution of arbitrary JavaScript code when higher privileged users view the affected settings.