Divi Theme CVE-2026-3851

Exploitation requires: (1) the attacker holds a WordPress Contributor role or higher on the target site - anonymous or Subscriber-level users cannot create or edit pages; (2) the Divi theme version is 4.27.6 or below; (3) the attacker constructs a Dynamic Content block using the legacy JSON format (rather than the modern @ET-DC@...@ marker format) to evade save-time sanitization; (4) the post_meta_key resolver is used with the enable_html attribute set to on, which is required to trigger the unsanitized meta-value output path. Exploitation is limited to sites that allow contributor-level users to publish or edit Divi pages. Sites where only administrators and editors create content face significantly reduced exposure, as the attacker cannot inject the payload without that role.

The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a scope-changed stored XSS that crosses trust boundaries to victim browsers. The PR:L metric correctly captures the Contributor-level authentication gate, which limits the exposed surface to users who can publish or edit posts - a relatively low bar in multi-author WordPress sites. The UI:N metric is debatable for stored XSS: a victim must visit the injected page, which is conventionally UI:R under CVSS 3.1 semantics; this may cause slight score inflation. No EPSS score or KEV listing was provided, and no public exploit has been identified, suggesting this has not yet seen automated or mass exploitation. The dual-flaw bypass nature (filter gap plus missing output encoding) makes the vulnerability technically interesting and likely straightforward to weaponize once the legacy JSON format is understood by an attacker. Real-world risk is meaningful for any WordPress instance where untrusted contributors can publish pages using Divi's Dynamic Content with post_meta_key blocks and enable_html enabled - but self-contained to that configuration. Sites using Divi in author/contributor-open deployments should treat this as a priority patch.

An attacker with a Contributor account on a Divi-powered WordPress site crafts a page using the Dynamic Content feature, embedding a legacy JSON format payload in a post_meta_key block with enable_html set to on. Because the save-time filter only scans for @ET-DC@...@ markers, the malicious legacy-format payload is stored unmodified. When any authenticated or unauthenticated visitor loads the page, the rendering engine silently converts the legacy JSON, resolves the post meta value without sanitization, and executes the attacker's JavaScript - enabling session cookie theft, credential harvesting, or malicious redirects. No public exploit code has been identified at time of analysis, but the two-step bypass is mechanically straightforward for an attacker familiar with Divi's internal dynamic content formats.