CVE-2026-93878: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Divigear DiviGear Carousel

CVE-2026-93878 is a stored cross-site scripting vulnerability in the DiviGear Carousel plugin for WordPress affecting all versions up to and including 5.2.0. The flaw exists in the update_license AJAX action, where input is not properly sanitized or escaped before being stored and later rendered unescaped in the DiviGear > Activation settings page. This allows an authenticated attacker with subscriber-level privileges or higher to inject arbitrary web scripts that execute in the context of an administrator viewing the affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

An attacker with subscriber-level or higher access can inject malicious JavaScript that executes in the context of an administrator's browser when they visit the plugin's Activation settings page. This can lead to partial compromise of confidentiality and integrity (CVSS impact: Confidentiality Low, Integrity Low, Availability None). The vulnerability does not require user interaction beyond the administrator visiting the page and does not affect availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user access and monitor for suspicious activity related to the DiviGear Carousel plugin. Avoid administrators visiting the Activation settings page if possible.