Description
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Divi | 5.0 – < 5.9.0 | 5.9.0 |
References
- https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/ exploit vdb-entry technical-description