CVE-2026-13712CWE-79cross-site-scripting

CVE-2026-13712

Medium · published August 16, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-16T10:16Z
References (1)
https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/ · [email protected]
EPSS history
Timeline
  • 16 AUG 06:00Z
    Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
    cvelistv5