CVE-2026-3851: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elegant Themes Divi
Description
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the `post_meta_key` resolver in `et_builder_filter_resolve_default_dynamic_content()` does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`, passing raw `get_post_meta()` output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1
Score 6.4medium
Affected software
Elegant Themes
Divi
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Divi theme for WordPress suffers from a stored XSS vulnerability due to two main flaws: (1) the save-time sanitization function only filters dynamic content markers in the '@ET-DC@...@' format but ignores the legacy JSON format, which is converted at render time, bypassing sanitization; (2) the post_meta_key resolver does not sanitize the resolved meta value with wp_kses_post() when HTML is enabled, allowing raw post meta data to be output directly. This enables authenticated attackers with Contributor-level access or higher to inject malicious scripts into pages, which execute upon page access by users.
Potential Impact
An attacker with Contributor-level or higher privileges can inject arbitrary JavaScript into pages via the Dynamic Content feature's legacy JSON format, leading to stored XSS. This can result in execution of malicious scripts in the context of users viewing the injected pages, potentially compromising user sessions or performing unauthorized actions. The impact is limited to confidentiality and integrity (partial), with no availability impact reported.
Mitigation Recommendations
A patch is available for this vulnerability. Since Divi is a cloud service, Elegant Themes manages the remediation server-side. Users should ensure their Divi installations are updated to a patched version as per vendor guidance. Check the vendor advisory for confirmation of patch deployment and further instructions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-09T20:07:38.681Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6a979d95acd9273b49b7bc49
Added to database: 09/02/2026, 03:52:53 UTC
Last enriched: 09/07/2026, 12:55:03 UTC
Last updated: 10/17/2026, 06:48:17 UTC
Views: 118
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.