CVE-2026-3851 Overview
CVE-2026-3851 is a Stored Cross-Site Scripting (XSS) vulnerability in the Divi theme for WordPress, affecting all versions up to and including 4.27.6. The flaw resides in the Dynamic Content feature, where the legacy JSON format bypasses save-time sanitization. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the affected page. The issue is tracked as [CWE-79] and was addressed in Divi 4.27.7.
Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes in the browser of any visitor, enabling session theft, defacement, and privilege escalation via administrator-targeted payloads.
Affected Products
- Divi theme for WordPress — all versions up to and including 4.27.6
- Fixed in Divi 4.27.7
- Elegant Themes Divi Builder ecosystem components using the shared Dynamic Content resolver
Discovery Timeline
- 2026-09-02 - CVE-2026-3851 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-3851
Vulnerability Analysis
The vulnerability results from two compounding flaws in Divi's Dynamic Content pipeline. The save-time sanitization filter et_builder_sanitize_dynamic_content_fields() inspects content for dynamic content markers only in the canonical @ET-DC@...@ format. The rendering engine, however, also accepts a legacy JSON representation that is silently converted to a dynamic content directive at render time. Attacker-controlled payloads in the legacy JSON form pass through the save filter untouched.
The second flaw exists in the post_meta_key resolver inside et_builder_filter_resolve_default_dynamic_content(). When the enable_html option is set to on, the resolver passes raw output from get_post_meta() directly into the rendered page without applying wp_kses_post(). Combining both flaws, a Contributor can craft a legacy-format Dynamic Content block that references a post meta key containing raw <script> tags, which the renderer emits verbatim.
Root Cause
The root cause is inconsistent trust boundaries between the sanitization layer and the rendering layer. The sanitizer and the renderer support different input grammars, and the renderer additionally trusts post meta values as HTML-safe when a user-controllable flag is enabled.
Attack Vector
An authenticated attacker with Contributor privileges submits a page or post containing a Divi module with a Dynamic Content field encoded in the legacy JSON format. The JSON specifies a post_meta_key resolver with enable_html set to on and points at a meta key the attacker previously populated with a script payload. When any user, including administrators, views the published page, the payload executes in their browser context.
No verified public exploit code is available. See the Wordfence advisory
and the Divi 4.27.7 changelog for technical detail.
Detection Methods for CVE-2026-3851
Indicators of Compromise
- Posts or pages authored by Contributor-level accounts containing serialized Divi shortcodes with embedded JSON structures referencing post_meta_key and enable_html
- Rows in wp_postmeta where meta values contain <script>, onerror=, or javascript: payloads not attributable to trusted plugins
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from Divi-rendered pages
- Newly created administrator accounts or password changes shortly after page views by privileged users
Detection Strategies
- Audit wp_posts for Divi module content containing legacy JSON dynamic content structures rather than the @ET-DC@ marker format
- Query wp_postmeta for meta values containing HTML tags and correlate with authors who hold only Contributor or Author roles
- Review web server access logs for anomalous script-loaded resources referenced by Divi-rendered pages
Monitoring Recommendations
- Enable WordPress audit logging for post creation, revision, and meta updates by non-Editor users
- Deploy a Content Security Policy in report-only mode to surface inline script execution originating from Divi-rendered pages
- Alert on privilege changes and new administrator account creation following recent Contributor activity
How to Mitigate CVE-2026-3851
Immediate Actions Required
- Update the Divi theme to version 4.27.7 or later on all WordPress installations
- Review and reduce Contributor and Author account privileges where the role is not required
- Audit recent post revisions and post meta entries created by low-privilege accounts for injected script payloads
- Rotate credentials for any administrator that has viewed content authored by untrusted Contributors since the vulnerability window
Patch Information
Elegant Themes released Divi 4.27.7 to remediate the issue. The patch extends et_builder_sanitize_dynamic_content_fields() to recognize the legacy JSON format and enforces wp_kses_post() on post_meta_key resolutions when enable_html is enabled. Details are documented in the Divi 4.27.7 changelog and the Wordfence Vulnerability Report.
Workarounds
- Restrict content submission privileges by removing the Contributor and Author roles from untrusted users until the patch is applied
- Disable the Divi Dynamic Content feature via theme configuration where feasible
- Deploy a web application firewall rule blocking POST requests that contain Divi legacy JSON dynamic content structures with enable_html set to on
# Verify installed Divi version via WP-CLI
wp theme get Divi --field=version
# Update Divi if a managed update source is configured
wp theme update Divi --version=4.27.7
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.