CVE-2026-13712

This is a contributor-to-administrator privilege escalation vulnerability in Divi theme, not a routine XSS. The CVSS 5.4 score is dangerously misleading. The Social Media Follow module in Divi versions prior to 5.9.0 accepts arbitrary URI schemes in social link settings, including javascript: URIs. When a contributor creates a post containing this module and an administrator later views that post, the javascript: payload executes in the administrator's session. This gives the contributor session tokens, admin credentials, or full site control. The vulnerability's true severity lies in the privilege escalation, not the XSS itself. WordPress contributor role is scoped to draft-only content without publishing capability—this vulnerability completely bypasses that boundary. The contributor doesn't phish or coerce; they simply plant a social follow link with a javascript: href and wait. Every subsequent administrator view re-triggers execution. One planted payload creates a persistent execution channel against all future admins who visit that post. The Social Media Follow module makes this attack particularly insidious because it bypasses typical security tooling. A social follow link with a javascript: URI looks legitimate in the editor—it is a social follow link, just with a malicious href. Content scanners, security plugins, and manual review workflows that catch obvious script tags won't flag this because the payload is structurally indistinguishable from intended functionality. Verify whether your Divi installation is at 5.9.0 or later. Confirm the patch adds both output escaping and server-side input validation—if it only escapes output, the underlying design assumption that module settings receive only predefined URLs remains unchallenged, creating recidivism risk. For multi-site WordPress running Divi, assess whether contributor-role users on any subsite can reach network admin context, which would enable cross-tenant escalation. The EPSS shows low exploitation probability, likely because 5.9.0 was released before widespread 5.x adoption, or because the attack requires specific preconditions. However, the disclosure itself is a risk inflection point—attackers now have a confirmed exploit path and a known patch version to target. The population of unpatched Divi installations, including abandoned sites or those running child themes that load vulnerable parent code, represents the actual exposure.

Reviewed through automated stages and approved by a human before publication.