CVE-2026-3851 in Divi Plugin
Summary
by MITRE • 09/02/2026
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the `post_meta_key` resolver in `et_builder_filter_resolve_default_dynamic_content()` does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`, passing raw `get_post_meta()` output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The Divi theme for WordPress contains a critical security vulnerability affecting all versions up to and including 4.27.6, specifically within the Dynamic Content feature's handling of legacy JSON data formats. This flaw results in Stored Cross-Site Scripting, allowing attackers to inject malicious scripts that persist on the server and execute when victims view affected pages. The root cause lies in a fundamental architectural inconsistency between how content is sanitized at save time versus how it is rendered during page generation. During the saving process, the theme employs a sanitization filter named et_builder_sanitize_dynamic_content_fields which is designed to strip or neutralize potentially dangerous code by searching for dynamic content markers formatted as ET-DC...@. However, this validation logic fails to account for an alternative legacy JSON format that the rendering engine silently converts at runtime. Because the save-time filter does not recognize or process this legacy structure, malicious payloads embedded in this format bypass security checks entirely and are stored directly in the database without modification.
The second component of this vulnerability involves the post_meta_key resolver function et_builder_filter_resolve_default_dynamic_content which is responsible for retrieving metadata values to populate dynamic content fields. When the enable_html setting is configured to on, this function retrieves raw data from the WordPress database using get_post_meta() and passes it directly into the page output without applying necessary sanitization functions such as wp_kses_post(). This omission means that any HTML or JavaScript code stored in these meta fields remains executable by the browser of anyone viewing the compromised content. The combination of bypassing save-time validation due to format inconsistency and failing to sanitize data at render time creates a reliable vector for persistent script injection, effectively turning legitimate dynamic content features into a mechanism for delivering malicious payloads.
The operational impact of this vulnerability is significant because it requires only Contributor-level access or higher on the WordPress site to exploit. This relatively low privilege requirement means that compromised user accounts with modest editing rights can be leveraged by attackers to inject persistent malware across multiple pages and posts. The resulting Stored Cross-Site Scripting attacks can lead to session hijacking, credential theft, defacement of website content, and redirection of users to malicious sites. Since the injected scripts execute in the context of the victim's browser with the same permissions as legitimate site interactions, attackers can potentially access sensitive administrative areas or exfiltrate user data if those pages are viewed by privileged administrators or other high-value targets. This aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and maps to ATT&CK techniques related to Client-side Injection such as T1059 Command and Scripting Interpretation through browser-based execution environments.
Mitigation strategies for this vulnerability involve immediate updates to the Divi theme version 4.27.6 or later where these flaws have been addressed by developers. Site administrators should ensure that all instances of WordPress are running patched versions of the theme to restore proper sanitization logic across both save and render phases. In environments where updating is not immediately feasible, temporary mitigations include restricting user roles with access to dynamic content features to only those who require it for operational purposes. Additionally implementing a Web Application Firewall can help detect and block requests containing suspicious patterns associated with cross-site scripting attempts although this serves as an auxiliary measure rather than a complete solution. Regular security audits focusing on custom code integrations within WordPress themes are also recommended to identify similar inconsistencies in input validation and output encoding practices that could lead to comparable vulnerabilities.