EUVD-2026-69830
GHSA-rp2j-7c4f-r683
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L for required Contributor role; UI:R because a victim must visit the injected page to trigger XSS; S:C for cross-browser scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter et_builder_sanitize_dynamic_content_fields() only searches for dynamic content markers in the @ET-DC@...@ format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the post_meta_key resolver in et_builder_filter_resolve_default_dynamic_content() does not apply wp_kses_post() to the resolved meta value when enable_html is set to on, passing raw get_post_meta() output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript payloads that execute against any visitor of an affected page. The vulnerability chains two compounding flaws: the save-time sanitization filter et_builder_sanitize_dynamic_content_fields() only recognizes the modern @ET-DC@...@ marker format, while the rendering engine silently accepts and converts a legacy JSON format, bypassing sanitization entirely; a second flaw in the post_meta_key resolver skips wp_kses_post() output encoding when enable_html is set to on, feeding raw get_post_meta() output directly into page HTML. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker holds a WordPress Contributor role or higher on the target site - anonymous or Subscriber-level users cannot create or edit pages; (2) the Divi theme version is 4.27.6 or below; (3) the attacker constructs a Dynamic Content block using the legacy JSON format (rather than the modern `@ET-DC@...@` marker format) to evade save-time sanitization; (4) the `post_meta_key` resolver is used with the `enable_html` attribute set to `on`, which is required to trigger the unsanitized meta-value output path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a scope-changed stored XSS that crosses trust boundaries to victim browsers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Divi theme to version 4.27.7 or later, which resolves both the legacy JSON sanitization bypass and the missing `wp_kses_post()` call in the `post_meta_key` resolver. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inje
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 d
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Con
Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contrib
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today