Executive brief
The Divi theme, a popular WordPress page builder and design tool, contains a stored cross-site scripting vulnerability in its Dynamic Content feature. Attackers with Contributor-level access can inject malicious scripts that execute whenever site visitors view affected pages, potentially stealing credentials, session tokens, or sensitive data. This impacts the security of any WordPress site using Divi up to version 4.27.6.
Technical details
The vulnerability stems from two compounding flaws in the Dynamic Content feature: (1) the save-time sanitization filter only checks for the standard `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that bypasses this filter at render time, and (2) the `post_meta_key` resolver fails to apply `wp_kses_post()` sanitization when `enable_html` is enabled, passing raw post metadata directly to output. An authenticated attacker with Contributor-level or higher permissions can exploit this to inject persistent XSS payloads. The vulnerability is fixed in version 4.27.7 and later.
Affected products
- Elegant Themes Divi up to 4.27.6
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 4.27.7