CVE-2026-3850: Divi WordPress Theme XSS Vulnerability

CVE-2026-3850 is a stored cross-site scripting vulnerability in the Divi WordPress theme affecting contact form redirects. Attackers with contributor access can inject malicious scripts that execute when users submit forms. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-3850 Overview

The Divi theme for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the et_pb_contact_form shortcode. The flaw affects all versions up to and including 4.27.6. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into the redirect_url parameter. The payload executes when a visitor submits the affected contact form, redirecting the browser through a javascript: URI. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level users can plant stored JavaScript payloads that execute in every visitor's browser upon contact form submission, enabling session theft, account takeover, and site defacement.

Affected Products

Divi theme for WordPress, all versions up to and including 4.27.6
Sites using the et_pb_contact_form shortcode from the Divi Builder
WordPress installations allowing Contributor or higher role registration

Discovery Timeline

2026-09-02 - CVE-2026-3850 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-3850

Vulnerability Analysis

The vulnerability originates in how the Divi theme processes the redirect_url attribute of the et_pb_contact_form shortcode. The theme applies esc_attr() to the value before rendering it into the data-redirect_url HTML attribute. esc_attr() escapes HTML entities but does not validate URL schemes, so javascript: URIs pass through unchanged.

Compounding the issue, the redirect_url key is missing from the hardcoded $url_options array in class-et-builder-element.php. That array drives esc_url_raw() sanitization during shortcode parsing. Because redirect_url is absent, the value never receives URL-scheme validation during server-side processing.

After a successful contact form submission, client-side JavaScript reads the data-redirect_url attribute and assigns it directly to window.location.href. Browsers evaluate javascript: URIs assigned to window.location.href, executing attacker-controlled script in the origin of the vulnerable site.

Root Cause

The root cause is the use of esc_attr() in place of esc_url() for a value destined to become a navigation target. esc_attr() addresses HTML-attribute injection but not dangerous URL schemes. The missing entry in $url_options removes the secondary sanitization layer that would have called esc_url_raw().

Attack Vector

An authenticated attacker with Contributor-level access inserts an et_pb_contact_form shortcode into a post or page and sets redirect_url to a javascript: URI containing arbitrary code. When any visitor submits the contact form on that page, the client-side handler navigates to the malicious URI, executing the injected script in the visitor's browser session.

Real exploitation code is not published. See the Wordfence Vulnerability Report ID 768fb279 for additional technical detail.

Detection Methods for CVE-2026-3850

Indicators of Compromise

Post or page content containing et_pb_contact_form shortcodes with a redirect_url attribute beginning with javascript:, data:, or vbscript:
Rendered HTML containing data-redirect_url attributes whose value is not an http:// or https:// URL
Contributor or Author accounts recently modifying pages that include Divi contact form modules

Detection Strategies

Query the WordPress wp_posts table for post_content matching et_pb_contact_form combined with redirect_url="javascript:
Inspect audit logs for post revisions from lower-privileged roles that add or modify contact form shortcodes
Deploy a web application firewall rule that inspects POST bodies to admin-ajax.php and post edit endpoints for redirect_url values with non-HTTP schemes

Monitoring Recommendations

Enable WordPress activity logging for post creation, edits, and shortcode changes by Contributor and Author roles
Monitor outbound browser telemetry and Content Security Policy (CSP) violation reports for unexpected script execution on pages hosting contact forms
Alert on new user registrations at Contributor level or above, especially followed by immediate content publication

How to Mitigate CVE-2026-3850

Immediate Actions Required

Update the Divi theme to a version later than 4.27.6 as published in the Divi Changelog
Audit all published and draft pages for et_pb_contact_form shortcodes containing a redirect_url attribute and remove any non-HTTP values
Restrict Contributor and Author role assignments and review recently created accounts for anomalies

Patch Information

Elegant Themes addressed the issue in a Divi release following 4.27.6. Refer to the Divi Changelog Update for exact version details and the Wordfence advisory for confirmation of the fixed version.

Workarounds

Temporarily disable the Divi contact form module or replace it with an alternative form plugin until patching is complete
Enforce a strict Content Security Policy that blocks inline script execution and javascript: URI navigation
Limit shortcode usage for Contributor-level accounts through role-management plugins that filter allowed shortcodes on save

bash

# Example CSP header to block javascript: URI navigation
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; navigate-to 'self' https:; base-uri 'self'"