CVE-2026-3853: Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist (which only contains url, buttonlink, buttonurl), so it never receives escurlraw() at save time. On the server side, the value is rendered into a data-image HTML attribute using escattr(), which encodes double quotes as ". However, the client-side JavaScript carousel code in custom.unified.js reads this attribute using jQuery's .data('image'), which returns the browser-decoded value (with " decoded back to "). The decoded value is then concatenated directly into an HTML string and injected into the DOM via jQuery.after() without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Divi theme for WordPressto a version that resolves this vulnerability.Fixed in 4.27.6Patch Divi <= 4.27.6 - Configuration
Update the shortcode save/render logic so the `image_src` field is included in the `$url_options` whitelist (it currently only contains `url`, `button_link`, `button_url`) and is sanitized with `esc_url_raw()` at save time before being rendered into the `data-image` HTML attribute.
Divi theme (WordPress) - et_pb_video_slider_item shortcode $url_options whitelist for image_src = exclude image_src from being treated as URL (add image_src to whitelist and sanitize with esc_url_raw at save time) - Configuration
Modify the client-side carousel code in `custom.unified.js` so the value read from `.data('image')` (browser-decoded) is properly re-escaped before concatenating it into an HTML string and inserting it via `jQuery.after()`.
Divi theme - carousel code (custom.unified.js) jQuery injection/escaping of decoded data-image = re-escape before concatenation and DOM injection - Compensating control
Restrict access to Divi content creation (Contributor+ capability that can set `et_pb_video_slider_item` and `image_src`) so only trusted users can create/edit pages where this shortcode is used.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. Sites that allow untrusted users to create or edit content are the most exposed.
When does injected script execute?
The attacker can store a malicious value in the Video Slider item's image_src shortcode parameter. The script executes when a user hovers over the affected carousel thumbnail.
What can be done while a patch is not yet applied?
Restrict Contributor and higher roles to trusted users, since those roles can supply the affected shortcode parameter. Review content created by such users for Video Slider items using image_src values that should not be present.