Vulnerability · Published Aug 16, 2026 · Assigned by WPScan

CVE-2026-13712Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

Medium 5.4

In plain English

A medium-severity cross-site scripting in Divi from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Divi	5.0 – before 5.9.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/ exploit, vdb-entry, technical-description