The Divi WordPress theme versions before 5.9.0 contain a CWE-79 Cross-Site Scripting vulnerability in the Social Media Follow module. The issue arises from improper escaping of module settings before outputting them in link attributes. This flaw enables users with contributor roles to store malicious JavaScript code that executes in the context of higher privileged users viewing the post, potentially leading to privilege escalation or session hijacking.

An attacker with contributor-level access can inject JavaScript code that executes when an administrator or other high-privilege user views the post. This could lead to unauthorized actions performed with the administrator's privileges, such as modifying site content, stealing credentials, or installing backdoors. The vulnerability affects site integrity and confidentiality but requires an attacker to have contributor access first.

No official patch or remediation is currently confirmed. Users should upgrade to Divi version 5.9.0 or later once available, as the vulnerability is fixed in versions after 5.9.0. Until then, restrict contributor permissions or avoid using the vulnerable Social Media Follow module settings. Monitor vendor advisories for updates on patches or official fixes.