Description

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the `post_meta_key` resolver in `et_builder_filter_resolve_default_dynamic_content()` does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`, passing raw `get_post_meta()` output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-02T04:17:52.860Z",
  "pubdate": "2026-09-02T04:17:52.860Z",
  "executiveSummary": "The Divi theme for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the Dynamic Content feature's legacy JSON format.\nThe flaw affects all versions up to and including 4.27.6, enabling authenticated users with at least Contributor-level access to inject malicious scripts into page content.\nThe vulnerability arises from a sanitization bypass where the rendering engine processes legacy JSON dynamic content formats that remain unvalidated by the save-time sanitization filters.\nBecause the resolved metadata is rendered without sufficient output encoding when the 'enable_html' flag is set, attackers can execute arbitrary JavaScript in the context of other users' sessions, including high-privileged administrators.\nSuccessful exploitation facilitates unauthorized actions, session hijacking, and potential full site compromise.\nThis vulnerability is critical due to the ease of exploitation by authenticated contributors and the potential for widespread impact on the WordPress installation's integrity and user security.",
  "technicalDetails": "The vulnerability is primarily rooted in an inconsistency between the security sanitization logic and the rendering engine's interpretation of dynamic content payloads.\nThe function 'et_builder_sanitize_dynamic_content_fields()' is intended to intercept and sanitize malicious markers; however, it strictly validates the '@ET-DC@...@' syntax. It fails to account for a legacy JSON-based dynamic content format that the rendering engine supports.\nAttackers can leverage this discrepancy by embedding malicious payloads within the legacy JSON format. Since this format is ignored by the 'et_builder_sanitize_dynamic_content_fields()' filter, the payload is successfully stored in the post metadata.\nThe second critical component of the flaw involves the 'et_builder_filter_resolve_default_dynamic_content()' function, which is responsible for resolving 'post_meta_key' dynamic content requests. When the 'enable_html' configuration parameter is enabled, the resolver retrieves the stored meta value using 'get_post_meta()' and returns it directly to the page output without passing the data through 'wp_kses_post()' or equivalent output escaping functions.\nAn authenticated Contributor can perform the following attack flow: 1) Create or edit a post, 2) Embed a malicious payload structured in the legacy JSON format designed to trigger the 'post_meta_key' dynamic content resolver, 3) Set 'enable_html' to 'on' within the dynamic content configuration, 4) Save the post. Once the page is accessed by any user (including an administrator), the server-side rendering process decodes the legacy JSON, resolves the meta key, and injects the raw, unescaped payload directly into the DOM.\nThe consequence is the execution of arbitrary JavaScript within the victim's browser session. This effectively bypasses standard WordPress contributor restrictions, as the script runs with the permissions of the viewing user, allowing for malicious actions such as account takeovers, administrative privilege escalation, or unauthorized site modifications."
}