CVE-2026-3853

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image_src attribute of the et_pb_video_slider_item shortcode in all versions up to, and including, 4.27.6. This is due to the image_src field not being included in the $url_options whitelist (which only contains url, button_link, button_url), so it never receives esc_url_raw() at save time. On the server side, the value is rendered into a data-image HTML attribute using esc_attr(), which encodes double quotes as ". However, the client-side JavaScript carousel code in custom.unified.js reads this attribute using jQuery's .data('image'), which returns the browser-decoded value (with " decoded back to "). The decoded value is then concatenated directly into an HTML string and injected into the DOM via jQuery.after() without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image_src attribute of the et_pb_video_slider_item shortcode in all versions up to, and including, 4.27.6. This is due to the image_src field not being included in the $url_options whitelist (which only contains url, button_link, button_url), so it never receives esc_url_raw() at save time. On the server side, the value is rendered into a data-image HTML attribute using esc_attr(), which encodes double quotes as ". However, the client-side JavaScript carousel code in custom.unified.js reads this attribute using jQuery's .data('image'), which returns the browser-decoded value (with " decoded back to "). The decoded value is then concatenated directly into an HTML string and injected into the DOM via jQuery.after() without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image_src attribute of the et_pb_video_slider_item shortcode in all versions up to, and including, 4.27.6. This is due to the image_src field not being included in the $url_options whitelist (which only contains url, button_link, button_url), so it never receives esc_url_raw() at save time. On the server side, the value is rendered into a data-image HTML attribute using esc_attr(), which encodes double quotes as ". However, the client-side JavaScript carousel code in custom.unified.js reads this attribute using jQuery's .data('image'), which returns the browser-decoded value (with " decoded back to "). The decoded value is then concatenated directly into an HTML string and injected into the DOM via jQuery.after() without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image_src attribute of the et_pb_video_slider_item shortcode in all versions up to, and including, 4.27.6. This is due to the image_src field not being included in the $url_options whitelist (which only contains url, button_link, button_url), so it never receives esc_url_raw() at save time. On the server side, the value is rendered into a data-image HTML attribute using esc_attr(), which encodes double quotes as ". However, the client-side JavaScript carousel code in custom.unified.js reads this attribute using jQuery's .data('image'), which returns the browser-decoded value (with " decoded back to "). The decoded value is then concatenated directly into an HTML string and injected into the DOM via jQuery.after() without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.