The Divi WordPress theme versions before 5.9.0 contain a CWE-79 Cross-Site Scripting vulnerability in the Social Media Follow module. The module fails to properly escape certain settings before outputting them in link attributes, enabling users with contributor roles to store malicious JavaScript. This script executes in the context of higher privileged users, such as administrators, when they view the post containing the injected code. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, low privileges required, and requires user interaction. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with contributor-level access can inject JavaScript code that executes in the browser of higher privileged users (e.g., administrators) when they view the post. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed with the administrator's privileges. Availability is not affected. The vulnerability requires the victim to interact by viewing the post.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level user capabilities to trusted users only and consider reviewing or disabling the Social Media Follow module settings to prevent untrusted input. Monitor for updates from the Divi theme vendor regarding patches or official mitigations.