Executive brief
The Divi theme for WordPress is a popular site builder and design framework used by many WordPress websites. Attackers with Contributor-level access can inject malicious scripts into video slider carousels that execute when site visitors hover over thumbnails, allowing theft of session tokens, credential harvesting, or defacement of website content.
Technical details
The vulnerability is a DOM-based stored cross-site scripting (XSS) flaw in the `et_pb_video_slider_item` shortcode's `image_src` attribute. The root cause is that `image_src` is not in the `$url_options` whitelist during sanitization, so it bypasses `esc_url_raw()` at save time. While the server-side rendering uses `esc_attr()` to output the value into a `data-image` attribute, client-side JavaScript in `custom.unified.js` retrieves this attribute with jQuery's `.data('image')` method, which automatically HTML-decodes the value (converting `"` back to `"`). The decoded value is then concatenated directly into HTML and injected via `jQuery.after()` without re-escaping. Exploitation requires Contributor-level or higher WordPress access; the injected payload executes when users interact with the carousel. The vulnerability affects Divi versions up to 4.27.6 and is fixed in 4.27.7 and later.
Affected products
- Elegant Themes Divi up to 4.27.6
Timeline
- 2026-09-05: disclosed