CVE-2026-13712

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

Affected

Divi

CVSS v3.1 CNA

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 12th percentile

Published

2026-08-16

Updated

2026-08-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/

References

• CVE Record
• NVD entry