Cross-Site Scripting in Divi WordPress Theme by Elegant Themes
CVE-2026-13712
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13712?
The Divi WordPress Theme, prior to version 5.9.0, contains a vulnerability in its Social Media Follow module where certain settings are not properly escaped before rendering in link attributes. This oversight permits contributors to inject JavaScript code, which could execute when a user with elevated privileges, like an administrator, views the affected post. This flaw underscores the need for users to promptly update to the latest version to mitigate potential exploitation.
Affected Version(s)
Divi 5.0 < 5.9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.