CVE-2026-93878

Name of the Vulnerable Software and Affected Versions DiviGear Carousel versions prior to 5.2.1

Description Insufficient input sanitization and output escaping in the DiviGear Carousel plugin for WordPress allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the update license AJAX Action, enabling the injection of arbitrary web scripts. The payload executes when an administrator accesses the DiviGear > Activation settings page, where the stored value is echoed unescaped into a single-quoted HTML value attribute.

Recommendations Update DiviGear Carousel to a version newer than 5.2.0.