# CVE-2026-3850: Elegant Themes Divi stored cross-site scripting in contact form

Source: https://junglewise.ai/threats/cve-2026-3850-elegant-themes-divi-stored-cross-site-scripting-in-contact-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-3850 · Severity: medium · CVSS 6.4 · Published 2026-09-02

The Divi WordPress theme contains a stored cross-site scripting (XSS) vulnerability in its contact form shortcode. Attackers with contributor-level access can inject malicious JavaScript that executes in visitors' browsers whenever they submit a contact form, potentially stealing login credentials, session tokens, or personal data submitted through the form.

Technologies: [Elegant Themes Divi](https://junglewise.ai/threats/technologies/divi). Vendors: [Elegant Themes](https://junglewise.ai/threats/vendors/elegant-themes).

## Quick answers

**Is CVE-2026-3850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3850 being exploited in the wild.

**How severe is CVE-2026-3850?** Medium severity, with a CVSS score of 6.4, published 2 September 2026.

**Which products and versions are affected?** Elegant Themes Divi up to 4.27.6.

**Is there a fix for CVE-2026-3850?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3850 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-3850?** Check whether you run Elegant Themes Divi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `et_pb_contact_form` shortcode's handling of the `redirect_url` parameter. The parameter is sanitized with `esc_attr()` instead of the safer `esc_url()` function, and is missing from the `$url_options` array in `class-et-builder-element.php`, preventing proper `esc_url_raw()` sanitization during parsing. When a user submits the contact form, client-side JavaScript reads the unsanitized `redirect_url` from a data attribute and passes it directly to `window.location.href`, allowing execution of `javascript:` URIs containing arbitrary code. This requires an authenticated attacker with Contributor access or above to inject the malicious payload via the shortcode editor, making it a stored XSS that triggers on every form submission by any visitor.

## Affected products

- Elegant Themes Divi up to 4.27.6

## Timeline

- 2026-09-02: disclosed

## References

- [https://www.divichangelog.com/divi-update](https://www.divichangelog.com/divi-update)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/768fb279-8d35-4002-91d8-c6a3b0f8f51d?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/768fb279-8d35-4002-91d8-c6a3b0f8f51d?source=cve)

## Related threats

- [Elegant Themes Divi arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-91707-elegant-themes-divi-arbitrary-shortcode-execution)
- [Elegant Themes Divi server-side request forgery in video thumbnail function](https://junglewise.ai/threats/cve-2026-4361-elegant-themes-divi-server-side-request-forgery-in-video-thumbnail)
- [Elegant Themes Divi DOM-based stored XSS in video slider](https://junglewise.ai/threats/cve-2026-3853-elegant-themes-divi-dom-based-stored-xss-in-video-slider)
- [Elegant Themes Divi stored XSS in Social Media Follow shortcode](https://junglewise.ai/threats/cve-2026-3852-elegant-themes-divi-stored-xss-in-social-media-follow-shortcode)
- [Elegant Themes Divi stored cross-site scripting in Dynamic Content](https://junglewise.ai/threats/cve-2026-3851-elegant-themes-divi-stored-cross-site-scripting-in-dynamic-content)