The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress contains insufficient input sanitization and output escaping on a number of widget attributes, allowing a contributor or higher level user to persist malicious scripts in stored content. When a page that includes the compromised widget is viewed, the embedded script executes in the victim’s browser, potentially exposing session data, hijacking accounts, or delivering additional payloads. This is a classic example of a stored cross‑site scripting flaw (CWE‑79).

All versions of the Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin up to and including 4.1.0 are affected. Any WordPress site that has installed these versions and permits contributors to create or edit widget instances can be compromised.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability requires authenticated access at the contributor level or higher, meaning that an internal attacker or a compromised contributor account could inject malicious scripts into widget content. Although the flaw is not yet listed in CISA KEV, the potential for cross‑site scripting makes it a significant threat to site visitors and the integrity of user sessions.