Executive brief
The Divi theme for WordPress is a popular page builder used by thousands of websites. A stored cross-site scripting vulnerability in the Social Media Follow module allows authenticated users with contributor-level access to inject malicious scripts that execute in the browsers of site visitors. This could result in account takeover, session hijacking, or redirection to malicious sites.
Technical details
A stored XSS vulnerability exists in the Divi theme's Social Media Follow module via the `skype_url` shortcode attribute. The root cause is a three-part sanitization failure: (1) the `skype_url` field is not included in the `$url_options` whitelist, preventing invocation of `esc_url_raw()` during shortcode processing, (2) the render code explicitly skips `esc_url()` for Skype URLs, and (3) only `sanitize_text_field()` is applied, which preserves quote characters enabling attribute breakout. The unsanitized value is interpolated directly into a single-quoted `href` attribute. An authenticated attacker with Contributor-level access or above can inject arbitrary JavaScript that executes whenever users interact with the injected element. The vulnerability affects Divi versions up to and including 4.27.6 and has been patched in version 4.27.7.
Affected products
- Elegant Themes Divi up to and including 4.27.6
Timeline
- 2026-09-03: disclosed