Description

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, and including, 4.27.6. This is due to the `redirect_url` attribute being sanitized with `esc_attr()` instead of `esc_url()` before being rendered into the `data-redirect_url` HTML data attribute. Additionally, `redirect_url` is absent from the hardcoded `$url_options` array in `class-et-builder-element.php`, so it does not receive `esc_url_raw()` sanitization during shortcode parsing. After a successful form submission, client-side JavaScript reads this data attribute and passes it directly to `window.location.href`, executing arbitrary JavaScript from a `javascript:` URI. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user submits the contact form.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-02T07:16:36.830Z",
  "pubdate": "2026-09-02T07:16:36.830Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw affecting the Divi theme for WordPress in all versions up to and including 4.27.6. The issue originates from improper input sanitization of the 'redirect_url' parameter within the 'et_pb_contact_form' shortcode.\nBy injecting a malicious 'javascript:' URI into the 'redirect_url' attribute, an authenticated attacker with at least Contributor-level privileges can execute arbitrary JavaScript in the context of the victim's session. The impact is significant, as successful exploitation leads to unauthorized client-side script execution upon form submission. This allows for potential session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious third-party sites.\nThe vulnerability requires the attacker to have existing access to the WordPress dashboard (Contributor level or higher), which is common in multi-user environments. Given that the payload is stored and triggered by form interactions, it represents a persistent threat to any user or administrator who interacts with a compromised contact form.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the 'redirect_url' attribute within the 'et_pb_contact_form' shortcode, specifically located within the 'class-et-builder-element.php' file. During the shortcode rendering process, the 'redirect_url' parameter is processed using 'esc_attr()' rather than the more appropriate 'esc_url()' function. 'esc_attr()' is designed to sanitize data for safe inclusion in HTML attributes, but it does not validate the protocol of a URL, thereby permitting the 'javascript:' pseudo-protocol.\nFurthermore, the 'redirect_url' attribute is omitted from the hardcoded '$url_options' array within the Divi framework. This omission means the attribute bypasses 'esc_url_raw()' sanitization, which would typically strip malicious protocols during the shortcode parsing phase. Consequently, a payload containing a 'javascript:' URI is stored directly in the database as part of the post content.\nWhen a user interacts with the 'et_pb_contact_form' on the frontend, the Divi theme renders the 'redirect_url' value into a 'data-redirect_url' HTML attribute. The theme's client-side JavaScript then reads this attribute and directly assigns the value to 'window.location.href'. By providing a string such as 'javascript:alert(document.cookie)', the attacker forces the browser to execute the included JavaScript code instead of navigating to a legitimate URL.\nThe attack flow proceeds as follows: First, an attacker with Contributor-level access creates or modifies a post containing the 'et_pb_contact_form' shortcode, inserting the malicious payload into the 'redirect_url' parameter. Second, the server persists this malicious attribute in the WordPress database. Third, when a victim (such as an administrator) submits the contact form, the frontend JavaScript captures the malicious 'data-redirect_url' value. Finally, the browser executes the payload via 'window.location.href', resulting in successful XSS. The privilege requirement of Contributor-level access is the primary constraint, but this is a common attack vector in WordPress environments where users have restricted but authenticated access."
}