Description

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-05T07:17:11.803Z",
  "pubdate": "2026-09-05T07:17:11.803Z",
  "executiveSummary": "The Divi theme for WordPress is susceptible to a DOM-based stored Cross-Site Scripting (XSS) vulnerability residing within the 'et_pb_video_slider_item' shortcode.\nThe vulnerability originates from inadequate input sanitization of the 'image_src' attribute during the save process, coupled with insecure DOM manipulation in the theme's JavaScript.\nSuccessful exploitation allows an authenticated attacker with at least Contributor-level privileges to inject malicious JavaScript payloads that execute in the context of the victim's session.\nThis flaw impacts all versions of Divi up to and including 4.27.6.\nThe risk implication is significant, as an attacker can execute arbitrary scripts when a user interacts with a specifically crafted video slider thumbnail.\nExploitation requires administrative or contributor-level access to the WordPress backend to modify posts or pages containing the affected shortcode.\nThis vulnerability highlights a critical failure in the data flow pipeline where sanitized attributes, once decoded by jQuery's data API, are treated as trusted input during subsequent DOM injection operations.",
  "technicalDetails": "The vulnerability manifests due to a mismatch between server-side attribute handling and client-side DOM processing. In the 'et_pb_video_slider_item' shortcode, the 'image_src' attribute is erroneously excluded from the '$url_options' whitelist, which mandates the application of 'esc_url_raw()' during the save process. Consequently, malicious payloads are stored without necessary sanitization.\nServer-side, the 'image_src' value is passed through 'esc_attr()' before being rendered into a 'data-image' attribute. While this converts double quotes to HTML entities ('"'), it does not prevent the inclusion of malicious JavaScript URI schemes or complex tag-breaking structures.\nThe client-side impact is triggered by the 'custom.unified.js' file, which utilizes jQuery's '.data('image')' method to access the 'data-image' attribute. A critical technical nuance here is that jQuery's '.data()' method automatically decodes HTML entities. Therefore, the '"' entities stored in the DOM are converted back into functional double quotes in the JavaScript memory space.\nThe exploitation flow proceeds as follows: 1. An authenticated attacker (Contributor+) embeds a malicious payload into the 'image_src' field of the 'et_pb_video_slider_item' shortcode. 2. Upon page load, the server renders the payload into a 'data-image' attribute. 3. The theme's 'custom.unified.js' initializes the carousel, invoking '.data('image')' and receiving the decoded, dangerous payload. 4. The script then concatenates this payload into an HTML string and uses 'jQuery.after()' to inject it directly into the DOM.\nBecause 'jQuery.after()' processes the string without further sanitization, any embedded script tags or event handlers (such as 'onmouseover') are executed. The attack is triggered when a user hovers over the thumbnail in the video slider, leading to potential session hijacking, unauthorized actions on behalf of the user, or further malicious redirections.\nThe failure point is identified as the lack of context-aware output encoding in the JavaScript component, which assumes that data retrieved from an HTML attribute is benign, disregarding the effect of the jQuery decoder and the subsequent dangerous injection method."
}