Divelogs Widget

Divelogs Widget has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Divelogs Widget has a vendor fix available, so running the current release closes it.

All of these findings were reported by Gilang - DJ. Divelogs Widget is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Divelogs Widget vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-13962

Divelogs Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Read the full analysis

Vulnerability Records

1 records


2025-12-11 14:46	Divelogs Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Divelogs Widget <= 1.5	`CVE-2025-13962`	6.4 Medium	Gilang - DJ	Yes

Showing 1–1 of 1 reports

Latestv1.6

Divelogs Widget

Author

klemmkeil

3.3(3)

66/100

Last Updated

2025-12-10 (9mo ago)

Active Installs

20+

Downloads

3,400

Requires WP

5.0+

Requires PHP

7.4+

Tested up to

WP 6.9.7

Created

2011-07-18 (15y ago)

Displays your latest dive from divelogs.de / divelogs.org in a widget. Currently german, english, french, dutch, spanish, italian and hebrew are supported. You can choose if you also want to display your dive’s profile graph. Also provides a shortcode to display your latest dive or any specific dive in a page

View on WordPress.org