CVE-2026-3852: Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: (1) the skypeurl field is not included in the $urloptions whitelist in class-et-builder-element.php, so it never invokes escurlraw() during shortcode processing, (2) the render code in SocialMediaFollowItem.php explicitly skips escurl() for Skype URLs (! $isskype ? escurl( $url ) : $skypeurl), and (3) only sanitizetextfield() is applied, which preserves single and double quote characters allowing attribute breakout. The unsanitized value is interpolated directly into a single-quoted href attribute (href='{$socialnetworklinkurl}'). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user interacts with the injected element.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Divi (WordPress theme)to a version that resolves this vulnerability.Fixed in 4.27.6 - Configuration
In the Social Media Follow module’s shortcode usage, ensure the `skype_url` (the shortcode attribute) is provided only as a properly URL-encoded safe value; avoid including single (`'`) or double (`"`) quote characters to prevent `href='{$social_network_link_url}'` attribute breakout.
WordPress Divi - Social Media Follow module skype_url shortcode attribute = Use only a properly URL-encoded, safe skype URL value (no quotes)
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to add or modify a Social Media Follow module and control its skype_url shortcode attribute.
When does the injected script execute?
The payload is stored in page content and executes when a user interacts with the injected Social Media Follow element. The issue does not require the victim to authenticate.
Are sites using the affected theme exposed by default?
Exploitation depends on a Contributor-or-higher account being available to an attacker and on use of the Social Media Follow module with attacker-controlled Skype URL content. The provided information does not establish that every default installation has such content or accounts.
What can be done while patching is delayed?
Restrict Contributor and higher access to trusted users, and review pages containing Social Media Follow modules for unexpected or malicious Skype URL values. Remove or disable suspicious injected elements until the theme can be updated.
How can administrators identify possible exploitation?
Review Social Media Follow module shortcode content, specifically skype_url attributes, for quote characters or unexpected markup that could break out of an href attribute. Focus on content created or edited by Contributor-level and other non-administrative accounts.