Description

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: (1) the `skype_url` field is not included in the `$url_options` whitelist in `class-et-builder-element.php`, so it never invokes `esc_url_raw()` during shortcode processing, (2) the render code in `SocialMediaFollowItem.php` explicitly skips `esc_url()` for Skype URLs (`! $is_skype ? esc_url( $url ) : $skype_url`), and (3) only `sanitize_text_field()` is applied, which preserves single and double quote characters allowing attribute breakout. The unsanitized value is interpolated directly into a single-quoted `href` attribute (`href='{$social_network_link_url}'`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user interacts with the injected element.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-03T13:05:38.903Z",
  "pubdate": "2026-09-03T13:05:38.903Z",
  "executiveSummary": "The Divi theme for WordPress, in versions up to and including 4.27.6, contains a critical Stored Cross-Site Scripting (XSS) vulnerability within the Social Media Follow module. The vulnerability arises from improper input sanitization and output encoding of the 'skype_url' shortcode attribute, allowing authenticated users with Contributor-level access or higher to inject malicious JavaScript payloads. When a victim interacts with or views the rendered module, the injected script executes within the context of the user's session. This flaw poses a significant security risk, as it permits unauthorized code execution, potential session hijacking, and the ability to perform actions on behalf of authenticated administrators or other users, thereby compromising the integrity and confidentiality of the WordPress installation.",
  "technicalDetails": "The vulnerability is localized to the Social Media Follow module, specifically triggered by the 'skype_url' attribute. The exploit leverages a failure in the application's sanitization and output escaping pipeline across three distinct layers. First, within 'class-et-builder-element.php', the 'skype_url' attribute is omitted from the '$url_options' whitelist, which prevents the application of 'esc_url_raw()' during the initial shortcode processing phase. Second, the rendering logic defined in 'SocialMediaFollowItem.php' contains an explicit conditional check that bypasses 'esc_url()' filtering when a Skype protocol is detected, defaulting to the raw 'skype_url' input. Third, the module utilizes 'sanitize_text_field()' as the primary input filter; this function is insufficient for URL contexts because it preserves single and double quote characters, which are critical for breaking out of HTML attributes.\nThe injection occurs because the unsanitized value is directly interpolated into a single-quoted 'href' attribute in the HTML output, structured as 'href='{$social_network_link_url}''. An attacker can craft a payload containing quotes and malicious JavaScript—such as 'skype:x' onmouseover='alert(1)'—to escape the attribute enclosure. By injecting an 'onmouseover' event handler or other event-based XSS vectors, the attacker causes the browser to interpret the injected string as executable code rather than a URI.\nThe attack flow requires the attacker to have at least Contributor-level privileges, enabling them to create or edit posts containing the vulnerable Divi shortcode. Once the attacker saves the post with the injected payload, the malicious script is stored in the WordPress database. When a user (including administrators) views the front-end page where the module is rendered, the payload is injected into the DOM. Post-exploitation, the script operates with the victim's privileges, allowing for unauthorized sensitive data exfiltration, administrative account modification, or the injection of additional persistent backdoors into the WordPress environment."
}