Live › vulnerability › CVE-2026-93878
Go to dashboardThe DiviGear Carousel plugin for WordPress up to and including 5.2.0 does not sanitize the license value saved through its update_license AJAX action, and echoes it unescaped on the Activation settings page. An authenticated user with subscriber-level access can store a script that runs in an administrator's browser when they open DiviGear > Activation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the DiviGear Carousel plugin at version 5.2.0 or earlier where subscriber-level or higher accounts can exist, since those accounts can reach the update_license action. The payload fires for administrators who open the DiviGear Activation settings page. Sites without the plugin, or running a patched version, can skip it.
No product ranges from the sources yet.
5.2.0 are affectedupdate_license AJAX action in the plugin source and confirm the license value is echoed without escaping on the Activation settings page5.2.0 once a fixed release is available; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, where the unsanitized stored value is echoed unescaped into a single-quoted HTML value attribute.
This page as .md · .json · in your agent: get_signal("CVE-2026-93878")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.