EUVD-2026-71886
GHSA-qpr5-j4j4-r5pg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L for required Contributor auth; UI:R because victim hover interaction triggers the DOM injection; S:C for cross-context XSS execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image_src attribute of the et_pb_video_slider_item shortcode in all versions up to, and including, 4.27.6. This is due to the image_src field not being included in the $url_options whitelist (which only contains url, button_link, button_url), so it never receives esc_url_raw() at save time. On the server side, the value is rendered into a data-image HTML attribute using esc_attr(), which encodes double quotes as ". However, the client-side JavaScript carousel code in custom.unified.js reads this attribute using jQuery's .data('image'), which returns the browser-decoded value (with " decoded back to "). The decoded value is then concatenated directly into an HTML string and injected into the DOM via jQuery.after() without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.
AnalysisAI
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level attackers to inject persistent arbitrary JavaScript via the image_src attribute of the et_pb_video_slider_item shortcode. The payload survives server-side sanitization because esc_attr() encodes double quotes as ", but jQuery's .data('image') call in custom.unified.js silently HTML-entity-decodes that value at runtime, and the decoded string is then concatenated into HTML and injected into the DOM via jQuery.after() with no further escaping. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account at Contributor level or above - anonymous or Subscriber-level users cannot inject the payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) contains a likely error: UI:N does not accurately reflect that victim execution requires hovering over a carousel thumbnail, which constitutes user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Divi version 4.27.7, which addresses this vulnerability by adding `image_src` to the `$url_options` whitelist so that `esc_url_raw()` is applied at save time, preventing storage of non-URL payloads. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inje
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 d
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all
Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Con
Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contrib
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today