CVE-2026-3853: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elegant Themes Divi

The Divi theme for WordPress is vulnerable to a DOM-based stored XSS through the image_src attribute of the et_pb_video_slider_item shortcode in all versions up to and including 4.27.6. The vulnerability arises because image_src is excluded from the whitelist of URL fields sanitized with esc_url_raw() at save time. On the server side, the attribute is rendered with esc_attr(), encoding quotes as ", but client-side JavaScript reads the data-image attribute using jQuery's .data('image'), which decodes " back to ". The decoded value is then concatenated into HTML and injected into the DOM without re-escaping, enabling script injection by authenticated users with Contributor or higher privileges.

An attacker with Contributor-level access or higher can inject arbitrary JavaScript code into pages via the image_src attribute. This script executes in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability does not require user interaction beyond hovering over the carousel thumbnail. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Avoid using the et_pb_video_slider_item shortcode with untrusted image_src values. Monitor vendor channels for updates and apply patches promptly once released.