Elegant Themes
Monthly
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level attackers to inject persistent arbitrary JavaScript via the `image_src` attribute of the `et_pb_video_slider_item` shortcode. The payload survives server-side sanitization because `esc_attr()` encodes double quotes as `"`, but jQuery's `.data('image')` call in `custom.unified.js` silently HTML-entity-decodes that value at runtime, and the decoded string is then concatenated into HTML and injected into the DOM via `jQuery.after()` with no further escaping. No public exploit or CISA KEV listing is identified; a patched release (4.27.7) is available per the Divi changelog.
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inject arbitrary scripts via the `skype_url` shortcode attribute, executing against any site visitor who interacts with the poisoned element. The flaw stems from a three-part sanitization failure: the field is excluded from the URL-option whitelist, the renderer explicitly bypasses `esc_url()` for Skype URLs, and the fallback `sanitize_text_field()` preserves quote characters enabling single-quoted HTML attribute breakout. Versions up to and including 4.27.6 are affected; a fix was released in 4.27.7. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated contributors to plant a `javascript:` URI in the `redirect_url` parameter of the `et_pb_contact_form` shortcode, which executes in any visitor's browser upon contact form submission. The flaw arises from using `esc_attr()` instead of `esc_url()` for sanitization and the parameter's absence from the `$url_options` URL-sanitization array, allowing the raw URI to reach client-side JavaScript that assigns it to `window.location.href`. No public exploit code or CISA KEV listing has been identified at time of analysis, but Divi's enormous deployment footprint makes this a meaningful aggregate risk despite the Contributor access prerequisite.
Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript payloads that execute against any visitor of an affected page. The vulnerability chains two compounding flaws: the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only recognizes the modern `@ET-DC@...@` marker format, while the rendering engine silently accepts and converts a legacy JSON format, bypassing sanitization entirely; a second flaw in the `post_meta_key` resolver skips `wp_kses_post()` output encoding when `enable_html` is set to `on`, feeding raw `get_post_meta()` output directly into page HTML. A patch was released in version 4.27.7 per the Divi changelog. No public exploit has been identified at time of analysis.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level attackers to inject persistent arbitrary JavaScript via the `image_src` attribute of the `et_pb_video_slider_item` shortcode. The payload survives server-side sanitization because `esc_attr()` encodes double quotes as `"`, but jQuery's `.data('image')` call in `custom.unified.js` silently HTML-entity-decodes that value at runtime, and the decoded string is then concatenated into HTML and injected into the DOM via `jQuery.after()` with no further escaping. No public exploit or CISA KEV listing is identified; a patched release (4.27.7) is available per the Divi changelog.
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inject arbitrary scripts via the `skype_url` shortcode attribute, executing against any site visitor who interacts with the poisoned element. The flaw stems from a three-part sanitization failure: the field is excluded from the URL-option whitelist, the renderer explicitly bypasses `esc_url()` for Skype URLs, and the fallback `sanitize_text_field()` preserves quote characters enabling single-quoted HTML attribute breakout. Versions up to and including 4.27.6 are affected; a fix was released in 4.27.7. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated contributors to plant a `javascript:` URI in the `redirect_url` parameter of the `et_pb_contact_form` shortcode, which executes in any visitor's browser upon contact form submission. The flaw arises from using `esc_attr()` instead of `esc_url()` for sanitization and the parameter's absence from the `$url_options` URL-sanitization array, allowing the raw URI to reach client-side JavaScript that assigns it to `window.location.href`. No public exploit code or CISA KEV listing has been identified at time of analysis, but Divi's enormous deployment footprint makes this a meaningful aggregate risk despite the Contributor access prerequisite.
Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript payloads that execute against any visitor of an affected page. The vulnerability chains two compounding flaws: the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only recognizes the modern `@ET-DC@...@` marker format, while the rendering engine silently accepts and converts a legacy JSON format, bypassing sanitization entirely; a second flaw in the `post_meta_key` resolver skips `wp_kses_post()` output encoding when `enable_html` is set to `on`, feeding raw `get_post_meta()` output directly into page HTML. A patch was released in version 4.27.7 per the Divi changelog. No public exploit has been identified at time of analysis.