CVE-2026-9714
Stored XSS in Simple Divi Shortcode WordPress Plugin
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| divi | shortcode | to 1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Simple Divi Shortcode plugin for WordPress and is related to the 'id' parameter of the [showmodule] shortcode. Detection would involve identifying instances where the 'id' parameter is used in shortcode attributes without proper escaping, potentially allowing stored cross-site scripting.
Since the vulnerability requires authenticated contributor-level access or higher to exploit, detection can include reviewing WordPress pages or posts for injected scripts within the 'id' attribute of the [showmodule] shortcode.
Specific commands are not provided in the available resources. However, administrators can search the WordPress database or content for suspicious shortcode usage patterns, such as using SQL queries or WP-CLI commands to find posts containing the [showmodule] shortcode with suspicious 'id' attributes.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Simple Divi Shortcode plugin to a version later than 1.2 where the vulnerability is fixed.
If an update is not immediately available, restrict contributor-level and higher user permissions to trusted users only, as exploitation requires authenticated access.
Additionally, review and sanitize any existing content that uses the [showmodule] shortcode to remove potentially malicious scripts injected via the 'id' parameter.
Can you explain this vulnerability to me?
The Simple Divi Shortcode plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.2. This vulnerability exists because the 'id' parameter of the [showmodule] shortcode is not properly sanitized or escaped in the showmodule_shortcode() function.
Specifically, the 'id' attribute is concatenated directly into a dynamically constructed shortcode string without using esc_attr() or any other escaping method. This allows an attacker to break out of the attribute context and inject arbitrary HTML or scripts.
Authenticated users with contributor-level access or higher can exploit this to inject malicious scripts that execute whenever any user views the infected page.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with contributor-level access or above to inject arbitrary web scripts into pages on a WordPress site using the Simple Divi Shortcode plugin.
When other users visit these infected pages, the malicious scripts will execute in their browsers, potentially leading to theft of user credentials, session hijacking, defacement, or distribution of malware.
Because the attack requires authenticated access, it may be harder to detect but can still cause significant harm to site integrity and user trust.