CVE-2026-3850: Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr() instead of escurl() before being rendered into the data-redirecturl HTML data attribute. Additionally, redirecturl is absent from the hardcoded $urloptions array in class-et-builder-element.php, so it does not receive escurlraw() sanitization during shortcode parsing. After a successful form submission, client-side JavaScript reads this data attribute and passes it directly to window.location.href, executing arbitrary JavaScript from a javascript: URI. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user submits the contact form.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Divi theme (WordPress)to a version that resolves this vulnerability.Fixed in 4.27.6 - Configuration
Update the shortcode rendering path so the `redirect_url` attribute is sanitized with `esc_url_raw()`/`esc_url()` and output safely into the `data-redirect_url` attribute (instead of using `esc_attr()`).
Divi theme - class-et-builder-element.php (et_pb_contact_form shortcode) Sanitize redirect_url with esc_url() / esc_url_raw() instead of esc_attr() and render safely into data-redirect_url = Use esc_url_raw() for redirect_url (not esc_attr()) - Compensating control
Implement a compensating client-side/server-side control to prevent `javascript:` URIs from being used as redirect targets (e.g., block/strip `javascript:` scheme values for `redirect_url` before they reach the page and before client-side sets `window.location.href`).
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to add or modify page content containing the et_pb_contact_form shortcode.
When does the injected script run?
The payload runs after a user successfully submits the affected contact form. The form's redirect_url value is read by client-side JavaScript and assigned to window.location.href, allowing a javascript: URI to execute.
Are sites running a default Divi installation affected?
A site is affected if it uses Divi version 4.27.6 or earlier and contains a contact form configured through the et_pb_contact_form shortcode with an attacker-controlled redirect_url value. Exploitation also requires a Contributor-or-higher account.
How can I check for existing exploitation?
Review pages and other editable content containing et_pb_contact_form shortcodes, especially those modified by Contributor-level or higher users. Inspect redirect_url values for javascript: URIs or other unexpected redirect targets.