CVE-2024-4490 in Elegant Themes Divi Theme, Extra Theme, Divi Page Builder Plugin
Summary
by MITRE • 05/14/2024
The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ parameter in versions up to, and including, 4.25.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified affects the Elegant Themes ecosystem, specifically encompassing the Divi theme, Extra theme, and the Divi Page Builder plugin for WordPress within versions up to and including 4.25.0. This security flaw is classified as a DOM-Based Stored Cross-Site Scripting (XSS) issue that originates from insufficient input sanitization and output escaping mechanisms applied to the title parameter. Unlike reflected XSS where malicious scripts are executed immediately via a crafted link, this stored variant allows an attacker to persistently inject arbitrary web scripts into the application's database or storage medium. The persistence of these scripts means they remain in the system until explicitly removed by an administrator, creating a long-term security risk for any user who interacts with the compromised content.
The technical root cause lies in the failure of the software to properly validate and encode data when processing the title field during page creation or modification operations. When an authenticated user submits a title containing malicious JavaScript code, the application stores this input without applying adequate sanitization filters on the backend nor implementing robust output escaping mechanisms before rendering it back to the browser via the Document Object Model. Consequently, when another user views the affected page, their web browser interprets and executes the injected script as if it were legitimate content from the trusted domain. This execution occurs within the context of the victim's session, granting the attacker access to all cookies, local storage data, and other sensitive information associated with that specific user account on the WordPress site.
From an operational perspective, this vulnerability poses a significant risk because it requires authentication but only demands contributor-level permissions or higher for exploitation. This relatively low privilege threshold means that malicious insiders, compromised accounts of content editors, or users who have been granted elevated access can exploit the flaw without needing administrative rights. The impact extends beyond simple data theft; attackers can perform actions on behalf of victims, such as modifying site settings, creating new posts with further malware, or defacing the website's appearance. In enterprise environments where multiple contributors manage content, this vulnerability facilitates lateral movement and persistent compromise, potentially leading to broader network infiltration if the WordPress instance is integrated with other critical business systems.
Industry standards categorize this flaw under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it aligns with CWE-83 regarding DOM-based XSS where client-side scripts process user input in an unsafe manner. In the context of the MITRE ATT&CK framework for enterprise security, this vulnerability supports techniques associated with Collection and Credential Access, particularly under T1059 Command and Scripting Interpreter or T1071 Application Layer Protocol if used to exfiltrate data. The stored nature of the attack also correlates with persistence mechanisms where attackers maintain a foothold by embedding malicious code in legitimate-looking content that continues to execute upon subsequent visits.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary solution is to upgrade all affected WordPress installations, themes, and plugins to version 4.25.1 or later, where the developers have implemented proper input validation and output encoding for the title parameter. Administrators should also enforce strict role-based access control policies, ensuring that only trusted individuals with essential privileges can create or edit content. Implementing a Web Application Firewall capable of detecting and blocking XSS payloads in HTTP requests provides an additional layer of defense by intercepting malicious inputs before they reach the application logic. Furthermore, enabling Content Security Policy headers can restrict the execution of inline scripts, thereby mitigating the impact even if some injection attempts succeed. Regular security audits and code reviews focusing on input sanitization practices are recommended to prevent similar vulnerabilities in custom themes or plugins that may lack such protections.