Divi Theme CVE-2026-3853

Exploitation requires an authenticated WordPress account at Contributor level or above - anonymous or Subscriber-level users cannot inject the payload. The affected site must be running the Divi theme with the video slider module (et_pb_video_slider_item shortcode) in use on at least one page. Victim execution requires a second user (the target) to load the affected page and hover over the carousel thumbnail; the JavaScript fires on mouseover via the jQuery carousel handler, not on simple page load. The hover interaction requirement meaningfully raises the practical bar compared to page-load-triggered XSS, but it is easily achievable against admin users who routinely preview or review content. There is no non-default configuration requirement beyond having Divi installed and the video slider shortcode on a page.

The provided CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) contains a likely error: UI:N does not accurately reflect that victim execution requires hovering over a carousel thumbnail, which constitutes user interaction (UI:R). Correcting to UI:R yields approximately 5.4, which is more representative. The scope-change flag (S:C) is appropriate since XSS executes in the victim's browser context outside the WordPress application boundary. The PR:L requirement - Contributor-level authentication - is the most significant real-world limiter: sites that restrict content-creation roles tightly are substantially protected, while sites that grant Contributor or Author roles broadly (common in multi-author blogs and editorial environments) face meaningful exposure. No KEV listing confirms active exploitation, and no public POC is identified at time of analysis. Given Divi's very large install base, even a medium-privilege pathway warrants prompt patching.

An attacker with a Contributor-level WordPress account edits or creates a page embedding a [et_pb_video_slider_item image_src='...malicious-payload...'] shortcode containing a crafted value that encodes JavaScript. The payload is stored in the database and rendered into a data-image attribute. When an authenticated victim - such as an administrator - visits the page and hovers over the carousel thumbnail, the jQuery carousel code decodes and injects the payload into the DOM, executing the script in the victim's browser session, enabling session cookie theft or administrative action hijacking. No public POC has been identified, but the Wordfence disclosure provides sufficient technical detail to reconstruct the attack.