Description

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-16T06:16:50.227Z",
  "pubdate": "2026-08-16T06:16:50.227Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists within the Divi WordPress theme before version 5.9.0. The vulnerability resides in the Social Media Follow module, which fails to properly sanitize and escape specific module settings before outputting them directly into link attributes.\nAn authenticated attacker holding a low-privileged role, specifically a contributor, can exploit this flaw by supplying malicious JavaScript payloads within the vulnerable module configurations when authoring or editing posts.\nThe primary impact of successful exploitation is the execution of arbitrary JavaScript code in the context of another user's session. The attack vector specifically triggers payload execution when a higher-privileged user, such as an administrator, views the affected post.\nThis introduces significant risk implications, as execution in the context of an administrative session could allow attackers to perform privileged actions, such as creating new rogue administrative accounts, modifying site configurations, or further compromising the underlying WordPress installation.\nNo complex exploitation requirements are noted beyond the necessity for the attacker to possess authenticated contributor access to the WordPress application and for a higher-privileged user to subsequently render the malicious post containing the injected Social Media Follow module settings.",
  "technicalDetails": "The root cause of this vulnerability is improper output neutralization, specifically a failure to apply appropriate contextual escaping or sanitization to user-supplied input. Within the Divi WordPress theme, parameters associated with the Social Media Follow module are processed and subsequently rendered directly into HTML link attributes without adequate verification or encoding of dangerous characters.\nThe vulnerable component is the Social Media Follow module embedded within the Divi WordPress theme affecting versions prior to 5.9.0. The authentication and privilege requirements necessitate that the malicious actor possesses at least a contributor role within the WordPress environment, allowing them to create or edit posts and configure module settings.\nExploitation occurs through a stored attack vector. The step-by-step attack flow begins with the contributor-level user crafting a malicious payload containing JavaScript code (e.g., event handlers or URI schemes such as javascript:) designed to execute within an attribute context. The attacker inputs this payload into the targeted settings of the Social Media Follow module and saves the post content.\nBecause the Divi theme fails to escape these values prior to outputting them inside HTML link attributes, the raw payload is safely stored within the database as part of the post's configuration data.\nThe payload behavior is triggered asynchronously when a higher-privileged user, such as a site administrator, navigates to and views the rendered post containing the malicious module output. As the browser parses the HTML attributes generated by the theme, the unescaped malicious JavaScript payload breaks out of the intended attribute context and executes within the Document Object Model (DOM).\nThe post-exploitation impact includes the execution of arbitrary scripts in the session of the viewing administrator. This enables potential session hijacking, unauthorized API requests, escalation of privileges, or the introduction of persistent backdoors depending on the capabilities executed by the malicious JavaScript payload within the administrative context."
}