Detections
Analytics
CVE-2026-13712
critical
Description
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
References
https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/