CVE-2026-93878: DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, where the unsanitized stored value is echoed unescaped into a single-quoted HTML value attribute.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and when does the injected code run?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. Their stored payload runs when an administrator opens the DiviGear > Activation settings page.
What does an attacker need to target in the plugin?
The attacker must be able to invoke the update_license AJAX action and submit a malicious value that is stored by the plugin. The vulnerable value is later rendered without escaping in a single-quoted HTML value attribute.
How can administrators check for possible exploitation?
Review access to the DiviGear > Activation settings page and inspect the stored license-related value for unexpected HTML or script content. Also review Subscriber-and-higher accounts and activity involving the update_license AJAX action.