Executive brief
The Simple Divi Shortcode plugin for WordPress, which allows users to display Divi library modules using shortcodes, contains a security flaw. An attacker with contributor-level access or higher can inject malicious scripts into website pages. These scripts will execute in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the showmodule_shortcode() function. The 'id' attribute of the [showmodule] shortcode is concatenated directly into a dynamically constructed shortcode string without using functions like esc_attr(). This allows authenticated attackers with contributor-level permissions or higher to break out of the attribute context and inject arbitrary HTML or web scripts. These scripts are stored on the server and execute whenever a user visits the compromised page. The issue is fixed in version 1.2.1.
Affected products
- Simple Divi Shortcode Simple Divi Shortcode Up to and including 1.2
Timeline
- 2026-05-29: disclosed
- 2026-05-29: advisory
- 2026-05-29: patched: Fixed in version 1.2.1
References
- https://plugins.trac.wordpress.org/browser/simple-divi-shortcode/trunk/simple_divi_shortcode.php
- https://plugins.trac.wordpress.org/browser/simple-divi-shortcode/trunk/simple_divi_shortcode.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-divi-shortcode/tags/1.2&new_path=%2Fsimple-divi-shortcode/tags/1.2.1
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f188337e-023e-498e-b752-b5f3fa7a9949?source=cve