Security Alert Summary
The Simple Divi Shortcode WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the handling of the id attribute of the [showmodule] shortcode. Authenticated users with contributor-level access or higher can inject script into pages, which will run when other users view an injected page.
CVE Details
- CVE ID: CVE-2026-9714
- Affected component: Simple Divi Shortcode plugin (showmodule shortcode)
- Affected versions: versions up to, and including, 1.2 (as stated in the description)
- Published: May 29, 2026 at 7:16:14 AM
- Last modified: May 29, 2026 at 1:09:05 PM
- CVSS v3.1 base score: 6.4 (MEDIUM)
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Authenticated attackers with low privileges (contributor-level access and above) can exploit this; no user interaction required per CVSS (UI:N)
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue that exists because the plugin’s showmodule_shortcode() function concatenates the id shortcode attribute directly into a dynamically constructed shortcode string without applying proper escaping such as esc_attr(). Insufficient input sanitization and output escaping allow an attacker to break out of the attribute context and inject arbitrary HTML and script into pages where the shortcode is used.
The injected script is stored in content generated by the shortcode and will execute in the browsers of users who view the affected page. The description names the specific function responsible (showmodule_shortcode()) and the id attribute as the vector; no other functions, endpoints, or checks are named in the provided data.
Impact is limited to what can be achieved via script execution in the browser context of viewing users. According to the CVSS data, the main impacts are limited confidentiality and integrity effects; availability is not impacted in the provided information.
How This Could Impact Your Website
In a typical site workflow, an internal contributor or an external contractor with contributor-level access could add or edit content that includes the vulnerable [showmodule] shortcode. By injecting JavaScript into the id attribute, that script would be stored in the page and execute whenever other users access it. Practical consequences may include exposure of information visible on the page (for example, contact details or user-profile data rendered on the page), and an increased risk of targeted phishing or social engineering against staff or site users.
For example, a contributor could insert script that modifies a page to show a fake login prompt or capture form data, increasing the chances that an editor or administrator who views that page could be tricked into revealing credentials or other sensitive data. The CVSS impact ratings indicate confidentiality and integrity impacts are low rather than a complete site compromise, so effects are likely limited to data accessible through users’ browsers and actions those users can perform.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and content changes for unusual behavior or unexpected script injections.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
References
- https://plugins.trac.wordpress.org/browser/simple-divi-shortcode/trunk/simple_divi_shortcode.php#L62
- https://plugins.trac.wordpress.org/browser/simple-divi-shortcode/trunk/simple_divi_shortcode.php#L63
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-divi-shortcode/tags/1.2&new_path=%2Fsimple-divi-shortcode/tags/1.2.1
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f188337e-023e-498e-b752-b5f3fa7a9949?source=cve
