{"id":"CVE-2026-93878","kind":"vulnerability","aliases":["CVE-2026-93878"],"related":[],"title":"DiviGear Carousel WordPress plugin: stored XSS via license update action","description":"The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, where the unsanitized stored value is echoed unescaped into a single-quoted HTML value attribute.","summary":"The DiviGear Carousel plugin for WordPress up to and including 5.2.0 does not sanitize the license value saved through its update_license AJAX action, and echoes it unescaped on the Activation settings page. An authenticated user with subscriber-level access can store a script that runs in an administrator's browser when they open DiviGear > Activation.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["divi","package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-subscriber-accounts","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed DiviGear Carousel plugin version in the WordPress admin Plugins screen; versions up to and including `5.2.0` are affected\n- Look for the plugin's `update_license` AJAX action in the plugin source and confirm the license value is echoed without escaping on the Activation settings page\n- Check whether untrusted subscriber accounts exist on the site","fix":"- Update DiviGear Carousel to a version later than `5.2.0` once a fixed release is available; the sources do not name the fixed version\n- Until patched, deactivate the plugin or restrict subscriber registration\n- Review stored license values for script tags","status":"open","published_at":"2026-10-20T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:59:33+00:00","updated_at":"2026-10-25T03:59:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update DiviGear Carousel to a version later than `5.2.0` once a fixed release is available; the sources do not name the fixed version\n- Until patched, deactivate the plugin or restrict subscriber registration\n- Review stored license values for script tags","reach":"internet","title":"DiviGear Carousel WordPress plugin: stored XSS via license update action","impact":"medium","summary":"The DiviGear Carousel plugin for WordPress up to and including 5.2.0 does not sanitize the license value saved through its update_license AJAX action, and echoes it unescaped on the Activation settings page. An authenticated user with subscriber-level access can store a script that runs in an administrator's browser when they open DiviGear > Activation.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","divi","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in an administrator's browser on the settings page","analyst_note":"Confirm the fixed plugin version and the vendor advisory; the sources do not name a patched release.","how_to_check":"- Check the installed DiviGear Carousel plugin version in the WordPress admin Plugins screen; versions up to and including `5.2.0` are affected\n- Look for the plugin's `update_license` AJAX action in the plugin source and confirm the license value is echoed without escaping on the Activation settings page\n- Check whether untrusted subscriber accounts exist on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version","no-subscriber-accounts"],"who_is_affected":"Sites running the DiviGear Carousel plugin at version 5.2.0 or earlier where subscriber-level or higher accounts can exist, since those accounts can reach the update_license action. The payload fires for administrators who open the DiviGear Activation settings page. Sites without the plugin, or running a patched version, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":3428,"output_tokens":704,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93878':13A,16A '5.2.0':36B,109C 'access':66B,129C,145C 'action':10A,49B,101C 'activ':56B,82B,159C 'administr':75B,155C 'ajax':48B,100C 'arbitrari':134C 'attack':124C 'attribut':177C 'authent':60B,123C 'browser':77B 'carousel':2A,28B,85C 'cross':94C 'cross-sit':93C 'cve':11A,14A 'divi':17B 'divigear':1A,27B,81B,84C,158C 'due':110C 'echo':51B,168C 'escap':117C 'execut':141C,152C 'host':21B 'html':175C 'includ':35B,108C 'inject':133C,147C,150C 'input':113C 'insuffici':112C 'level':65B,128C 'licens':8A,41B,47B,99C 'make':119C 'open':80B 'output':116C 'packag':18B 'page':58B,138C,148C,161C 'payload':151C 'plugin':4A,25B,29B,86C 'possibl':121C 'quot':174C 'run':72B 'sanit':39B,114C 'save':43B 'script':70B,96C,136C 'self':20B 'self-host':19B 'set':57B,160C 'singl':173C 'single-quot':172C 'site':95C 'store':5A,68B,92C,165C 'subscrib':64B,127C 'subscriber-level':63B,126C 'unescap':53B,169C 'unsanit':164C 'updat':9A,46B,98C 'user':61B,144C 'valu':42B,166C,176C 'version':104C 'via':7A,97C 'visit':156C 'vulner':90C 'web':135C 'whenev':142C 'wordpress':3A,22B,24B,31B,88C 'wordpress-plugin':23B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the DiviGear Carousel plugin at version 5.2.0 or earlier where subscriber-level or higher accounts can exist, since those accounts can reach the update_license action. The payload fires for administrators who open the DiviGear Activation settings page. Sites without the plugin, or running a patched version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93878","severity":null,"published_at":"2026-10-20T07:17:09+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}