CVE-2026-3851: Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter etbuildersanitizedynamiccontentfields() only searches for dynamic content markers in the @ET-DC@...@ format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the postmetakey resolver in etbuilderfilterresolvedefaultdynamiccontent() does not apply wpksespost() to the resolved meta value when enablehtml is set to on, passing raw getpostmeta() output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. Exploitation requires the attacker to inject content into a page using Divi's Dynamic Content feature with the legacy JSON format and HTML enabled.
Are pages exposed merely by running an affected Divi version?
The provided information identifies affected versions through 4.27.6, but exploitation depends on an attacker having authenticated Contributor-or-higher access and being able to place the crafted dynamic-content payload on a page. The injected script executes when someone accesses that page.
What makes the legacy JSON format significant for detection and remediation?
The legacy JSON representation is converted during rendering but is not recognized by Divi's save-time dynamic-content sanitization filter. When it resolves a post-meta value with enable_html set to on, the value can be output without wp_kses_post() sanitization.
What version addresses the issue?
The affected range is stated as all Divi versions up to and including 4.27.6. The supplied update reference identifies Divi 4.27.7, but the data does not explicitly state its remediation details.