Executive brief
The Divi WordPress theme contains a stored cross-site scripting (XSS) vulnerability in its contact form shortcode. Attackers with contributor-level access can inject malicious JavaScript that executes in visitors' browsers whenever they submit a contact form, potentially stealing login credentials, session tokens, or personal data submitted through the form.
Technical details
The vulnerability exists in the `et_pb_contact_form` shortcode's handling of the `redirect_url` parameter. The parameter is sanitized with `esc_attr()` instead of the safer `esc_url()` function, and is missing from the `$url_options` array in `class-et-builder-element.php`, preventing proper `esc_url_raw()` sanitization during parsing. When a user submits the contact form, client-side JavaScript reads the unsanitized `redirect_url` from a data attribute and passes it directly to `window.location.href`, allowing execution of `javascript:` URIs containing arbitrary code. This requires an authenticated attacker with Contributor access or above to inject the malicious payload via the shortcode editor, making it a stored XSS that triggers on every form submission by any visitor.
Affected products
- Elegant Themes Divi up to 4.27.6
Timeline
- 2026-09-02: disclosed