CVE-2026-3850: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elegant Themes Divi

The Divi theme for WordPress contains a stored Cross-Site Scripting vulnerability in the et_pb_contact_form shortcode's redirect_url parameter. This parameter is sanitized using esc_attr() instead of the appropriate esc_url(), and it is not included in the $url_options array for esc_url_raw() sanitization during shortcode parsing. Consequently, after a form submission, client-side JavaScript reads the data-redirect_url attribute and assigns it directly to window.location.href, enabling execution of arbitrary JavaScript from a javascript: URI. This allows authenticated users with Contributor-level permissions or higher to inject malicious scripts that execute upon form submission.

An attacker with Contributor-level access or above can inject arbitrary JavaScript code that executes in the context of users submitting the contact form. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability does not require user interaction beyond form submission and does not affect availability. The CVSS v3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or restricting use of the et_pb_contact_form shortcode with the redirect_url parameter. Monitor official Elegant Themes communications for updates and patches addressing this vulnerability.