The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr() instead of escurl() before being rendered into the data-redirecturl HTML data attribute. Additionally, redirecturl is absent from the hardcoded $urloptions array in class-et-builder-element.php, so it does not receive escurlraw() sanitization during shortcode parsing. After a successful form submission, client-side JavaScript reads this data attribute and passes it directly to window.location.href, executing arbitrary JavaScript from a javascript: URI. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user submits the contact form.