UNKNOWN NVD

CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowi

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

References

https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/

Published: 2026-08-16 · Source: NVD · Feed updated: 2026-08-16

This unknown severity vulnerability was published on 2026-08-16 via NVD.

vulnfeed aggregates 11832 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.