The Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not properly sanitized or escaped, enabling authenticated users with Author-level privileges or above to embed arbitrary scripts. These scripts execute in the context of users who view the SVG files, potentially leading to information disclosure or session hijacking. The vulnerability is present in all plugin versions up to 1.4. No official patch or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user with Author-level access or higher to inject persistent malicious scripts via SVG uploads. These scripts execute in the browsers of users who view the SVG files, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability does not affect availability. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions to trusted users only and consider disabling SVG uploads if possible. Monitor plugin updates from the vendor and apply any official patches promptly once released.