Stored XSS Vulnerability in DiviGear Carousel Plugin for WordPress
CVE-2026-93878

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Divigear Carousel
Vendor
CVE Published:
20 October 2026

What is CVE-2026-93878?

The DiviGear Carousel plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) via the update_license AJAX action. This issue arises in all versions up to and including 5.2.0 due to a lack of proper input sanitization and output escaping. Attackers with subscriber-level access can exploit this flaw to inject arbitrary scripts that will execute whenever a user accesses the affected page. The risk is particularly significant when an administrator visits the settings page, as unsanitized values are displayed directly in the HTML value attribute.

Affected Version(s)

DiviGear Carousel 0 <= 5.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.divigear.com/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Austin Ginder
.