CVE-2026-3853 in Divi Plugin
Summary
by MITRE • 09/05/2026
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The Divi theme for WordPress contains a significant security vulnerability classified as DOM-Based Stored Cross-Site Scripting within versions up to 4.27.6. This flaw resides specifically in the handling of the image_src attribute associated with the et_pb_video_slider_item shortcode. The root cause is a failure in input validation and output encoding during the data lifecycle. When content containing this shortcode is saved, the system utilizes a whitelist approach for URL sanitization via the esc_url_raw function. However, the image_src field was inadvertently omitted from the $url_options array, which only includes url, button_link, and button_url. Consequently, user-supplied input provided in the image_src attribute bypasses server-side URL validation and escaping mechanisms entirely during the save process.
On the server side, the application attempts to mitigate risks by rendering the value into a data-image HTML attribute using the esc_attr function. This function correctly encodes special characters such as double quotes into their corresponding HTML entities, specifically converting them to ". While this appears secure at first glance because the raw malicious payload is stored in an encoded state within the database and initial HTML output, the vulnerability manifests during client-side processing. The theme employs a JavaScript carousel implementation located in custom.unified.js that interacts with these data attributes.
The critical failure occurs when the client-side script retrieves the value of the data-image attribute using jQuery's .data method. Unlike direct DOM property access or innerHTML manipulation which might preserve encoded entities, jQuery's .data() function performs automatic decoding of HTML entities before returning the string to JavaScript variables. This means that " is converted back into a literal double quote character in memory. The script then concatenates this decoded value directly into an HTML string and injects it into the Document Object Model using jQuery.after(). Because the input has been decoded but not re-escaped for its new context as part of an injected HTML fragment, any malicious JavaScript payload contained within the image_src attribute is executed by the browser.
This vulnerability allows authenticated attackers with Contributor-level access or higher to store arbitrary web scripts on the targeted site. The execution trigger is specific and requires user interaction; the script executes whenever a visitor hovers over the carousel thumbnail associated with the compromised shortcode. This behavior classifies the issue under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, because the attack vector involves stored content that is later executed in the context of other users' browsers, it aligns with ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution.
The operational impact of this vulnerability extends beyond simple script injection. An attacker can leverage this to steal session cookies, perform actions on behalf of authenticated users, deface the website, or redirect visitors to malicious sites designed for phishing or malware distribution. The requirement for Contributor-level access means that lower-privileged accounts such as subscribers cannot exploit this flaw directly, but it remains a serious risk given that content creators often have elevated permissions and may not be aware of security implications in their input fields.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the Divi theme to version 4.27.7 or later, where this whitelist has been corrected to include image_src in the esc_url_raw processing pipeline. For sites unable to update immediately, a temporary workaround involves restricting who can publish content containing video sliders or manually sanitizing any existing instances of the shortcode by ensuring no malicious scripts are present in the image source fields. Additionally, implementing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed, thereby reducing the effectiveness of injected payloads even if they bypass other defenses.