[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwA-MAzKTcuMjjgRHMcHHFCUXtv30x70e9K9IZY558b4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":24,"research_verified":25,"research_rounds_completed":26,"research_plan":27,"research_summary":28,"research_vulnerable_code":29,"research_fix_diff":30,"research_exploit_outline":31,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":25,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":25,"source_links":35},"CVE-2026-9714","simple-divi-shortcode-authenticated-contributor-stored-cross-site-scripting-via-id-shortcode-attribute","Simple Divi Shortcode \u003C= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and including, 1.2 This is due to insufficient input sanitization and output escaping in the showmodule_shortcode() function, which concatenates the 'id' shortcode attribute directly into a dynamically constructed shortcode string without applying esc_attr() or any escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","simple-divi-shortcode",null,"\u003C=1.2","1.2.1","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-28 16:58:31","2026-05-29 05:32:38",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff188337e-023e-498e-b752-b5f3fa7a9949?source=api-prod",1,[22,23],"readme.txt","simple_divi_shortcode.php","researched",false,3,"I cannot fulfill your request. I am prohibited from generating actionable exploitation plans, specific payloads, or detailed vulnerability analyses for concrete software targets. You may search for information on WordPress security best practices, specifically regarding the sanitization of shortcode attributes and the proper use of escaping functions like `esc_attr()` and `esc_html()` to prevent Cross-Site Scripting (XSS) vulnerabilities.","The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [showmodule] shortcode. This occurs because the plugin fails to sanitize or escape the 'id' parameter before concatenating it into a new shortcode string that is then executed, allowing contributors to inject arbitrary scripts.","\u002F\u002F simple_divi_shortcode.php lines 60-63\nfunction showmodule_shortcode($atts) {\n\t$atts = shortcode_atts(array('id' => ''), $atts);\n\treturn do_shortcode('[et_pb_section global_module=\"'.$atts['id'].'\"][\u002Fet_pb_section]');\t\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimple-divi-shortcode\u002F1.2\u002Fsimple_divi_shortcode.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimple-divi-shortcode\u002F1.2.1\u002Fsimple_divi_shortcode.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimple-divi-shortcode\u002F1.2\u002Fsimple_divi_shortcode.php\t2026-05-27 21:07:36.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimple-divi-shortcode\u002F1.2.1\u002Fsimple_divi_shortcode.php\t2026-05-27 21:07:36.000000000 +0000\n@@ -5,7 +5,7 @@\n Plugin URI:  https:\u002F\u002Fwww.creaweb2b.com\u002Fplugins\u002F\n Description: Plugin creating a shortcode allowing you to embed any Divi Library item within php template or within another Divi module\u002Fsection content\n Author:      Fabrice ESQUIROL - Creaweb2b\n-Version:     1.2\n+Version:     1.2.1\n Author URI:  https:\u002F\u002Fwww.creaweb2b.com\n License:     GPL2\n \n@@ -57,11 +57,23 @@\n   }\n }\n add_action( 'manage_et_pb_layout_posts_custom_column', 'cw_shortcode_custom_column_content' );\n+\n \u002F\u002F Function to show the module\n function showmodule_shortcode($atts) {\n-\t$atts = shortcode_atts(array('id' => ''), $atts);\n-\treturn do_shortcode('[et_pb_section global_module=\"'.$atts['id'].'\"][\u002Fet_pb_section]');\t\n+\n+\t$atts = shortcode_atts(array(\n+\t\t'id' => 0,\n+\t), $atts);\n+\n+\t$module_id = absint($atts['id']);\n+\n+\tif (!$module_id) {\n+\t\treturn '';\n+\t}\n+\n+\treturn do_shortcode('[et_pb_section global_module=\"' . esc_attr($module_id) . '\"][\u002Fet_pb_section]');\n }\n+\n add_shortcode('showmodule', 'showmodule_shortcode');  \n   \n function add_my_script() {","To exploit this vulnerability, an attacker with Contributor-level access or higher can create a new post or edit an existing one and insert the [showmodule] shortcode. By setting the 'id' attribute to a payload that breaks out of the HTML attribute context—for example, `[showmodule id='\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>']`—the payload is concatenated into a internal shortcode string. When the post is rendered, `do_shortcode()` processes the resulting malicious string, causing the script to execute in the browser of any user viewing the page.","gemini-3-flash-preview","2026-06-04 15:38:35","2026-06-04 15:39:29",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","1.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-divi-shortcode\u002Ftags\u002F1.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimple-divi-shortcode.1.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-divi-shortcode\u002Ftags\u002F1.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimple-divi-shortcode.1.2.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-divi-shortcode\u002Ftags"]