CVE-2026-13712
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Divi WordPress theme before version 5.9.0 does not properly escape some Social Media Follow module settings before outputting them in link attributes, allowing users with contributor role or above to store JavaScript that executes when a higher-privileged user, such as an admin, views the post.
Risk Assessment
The risk includes admin session hijacking and execution of malicious code in the admin's browser context, potentially leading to site compromise.
Recommendation
Update the theme to version 5.9.0 or later and restrict lower roles from editing module settings.
Original NVD description (English source)
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.