# CVE-2026-91707: Elegant Themes Divi arbitrary shortcode execution

Source: https://junglewise.ai/threats/cve-2026-91707-elegant-themes-divi-arbitrary-shortcode-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91707 · Severity: medium · CVSS 5.3 · Published 2026-09-18

The Divi WordPress theme allows unauthenticated attackers to execute arbitrary shortcodes due to insufficient validation of user input before processing shortcode actions. When the optional 'Force Enable D4 Shortcode Framework' setting is enabled, attackers can abuse the contact form shortcode to send emails to arbitrary recipients with attacker-controlled content, potentially enabling phishing or spam campaigns against site visitors and owners.

Technologies: [Elegant Themes Divi](https://junglewise.ai/threats/technologies/divi). Vendors: [Elegant Themes](https://junglewise.ai/threats/vendors/elegant-themes).

## Quick answers

**Is CVE-2026-91707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91707 being exploited in the wild.

**How severe is CVE-2026-91707?** Medium severity, with a CVSS score of 5.3, published 18 September 2026.

**Which products and versions are affected?** Elegant Themes Divi up to and including 5.11.1.

**Is there a fix for CVE-2026-91707?** A patch was published on 2026-09-18: Fixed in version 5.12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91707 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-91707?** Check whether you run Elegant Themes Divi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a missing input validation flaw in the Divi theme's shortcode processing. The vulnerable code accepts user-supplied input and passes it to WordPress's do_shortcode() function without proper sanitization or validation. The attack is unauthenticated and network-accessible; no user interaction is required. When the D4 Shortcode Framework is enabled, attackers can specifically invoke the et_pb_contact_form shortcode to manipulate email routing and content. A patch is available in version 5.12.0 and later.

## Affected products

- Elegant Themes Divi up to and including 5.11.1

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 5.12.0

## References

- [https://www.divichangelog.com/](https://www.divichangelog.com/)
- [https://www.divichangelog.com/divi-update/divi-5/version-5-12-0](https://www.divichangelog.com/divi-update/divi-5/version-5-12-0)

## Related threats

- [Elegant Themes Divi server-side request forgery in video thumbnail function](https://junglewise.ai/threats/cve-2026-4361-elegant-themes-divi-server-side-request-forgery-in-video-thumbnail)
- [Elegant Themes Divi DOM-based stored XSS in video slider](https://junglewise.ai/threats/cve-2026-3853-elegant-themes-divi-dom-based-stored-xss-in-video-slider)
- [Elegant Themes Divi stored XSS in Social Media Follow shortcode](https://junglewise.ai/threats/cve-2026-3852-elegant-themes-divi-stored-xss-in-social-media-follow-shortcode)
- [Elegant Themes Divi stored cross-site scripting in contact form](https://junglewise.ai/threats/cve-2026-3850-elegant-themes-divi-stored-cross-site-scripting-in-contact-form)
- [Elegant Themes Divi stored cross-site scripting in Dynamic Content](https://junglewise.ai/threats/cve-2026-3851-elegant-themes-divi-stored-cross-site-scripting-in-dynamic-content)