CVE-2026-3853 Overview
The Divi theme for WordPress contains a DOM-based stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the image_src attribute of the et_pb_video_slider_item shortcode. All versions up to and including 4.27.6 are affected. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users hover over a carousel thumbnail. The vulnerability stems from an incomplete server-side URL whitelist combined with unsafe client-side DOM injection in custom.unified.js.
Critical Impact
Authenticated Contributor accounts can persist arbitrary scripts inside published pages, enabling session theft, admin action forgery, and site defacement against any visitor who interacts with a compromised video carousel.
Affected Products
- Divi theme for WordPress, versions up to and including 4.27.6
- Divi Builder shortcode component et_pb_video_slider_item
- Client-side asset custom.unified.js shipped with the theme
Discovery Timeline
- 2026-09-05 - CVE-2026-3853 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-3853
Vulnerability Analysis
The flaw is a stored XSS with a DOM-based execution sink. The Divi theme accepts an image_src value when a contributor saves an et_pb_video_slider_item shortcode. The value is written to post content without URL sanitization and later re-emitted into the browser, where jQuery decodes it and injects it into the DOM as HTML.
Exploitation requires only Contributor-level access, and the payload triggers whenever a visitor hovers the thumbnail. Because Divi is widely deployed on multi-author WordPress sites, low-privileged marketing or editorial accounts become viable footholds for attacks against administrators.
Root Cause
At save time, the $url_options whitelist inside the shortcode handler contains only url, button_link, and button_url. The image_src field is not in that list, so esc_url_raw() is never applied. The raw attacker-supplied string is stored in post meta and rendered server-side into a data-image HTML attribute using esc_attr(). That encoder escapes double quotes as " but does not sanitize URL schemes or angle-bracket content inside the value.
On the client, the carousel script reads the attribute using jQuery's .data('image'), which returns the browser-decoded value with " decoded back to ". The decoded string is concatenated directly into an HTML template and inserted into the DOM through jQuery.after() without re-escaping, producing script execution.
Attack Vector
An authenticated attacker with Contributor or higher privileges creates or edits a post containing an et_pb_video_slider_item shortcode. They set the image_src attribute to a crafted string containing a double quote that closes the data-image attribute followed by additional HTML, such as an <img> tag with an onerror handler. When any visitor or reviewing administrator hovers the thumbnail, the injected script executes in their browser session under the site origin.
See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-3853
Indicators of Compromise
- Post content containing et_pb_video_slider_item shortcodes where the image_src parameter includes characters such as ", <, >, or onerror=
- data-image HTML attributes in rendered pages containing encoded " sequences followed by additional HTML fragments
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that use the Divi video slider
Detection Strategies
- Query the wp_posts table for post content matching the pattern et_pb_video_slider_item combined with image_src= values containing quotes or angle brackets
- Inspect rendered HTML for data-image attributes whose decoded content is not a valid URL
- Correlate content edits by Contributor-role accounts with subsequent page renders that contain suspicious inline handlers
Monitoring Recommendations
- Enable WordPress audit logging for post creation and updates performed by Contributor and Author roles
- Deploy a web application firewall rule that inspects et_pb_video_slider_item shortcode parameters for XSS payload patterns
- Monitor Content Security Policy (CSP) violation reports for inline script executions originating from Divi-rendered pages
How to Mitigate CVE-2026-3853
Immediate Actions Required
- Upgrade the Divi theme to version 4.27.7 or later on all WordPress installations
- Audit existing posts and templates for et_pb_video_slider_item shortcodes containing suspicious image_src values and remove or sanitize them
- Review Contributor and Author accounts created in the last 90 days and revoke any that are not legitimate
Patch Information
Elegant Themes addressed the issue in Divi 4.27.7 by adding the image_src field to the URL sanitization whitelist so that esc_url_raw() is applied at save time. Full release notes are available in the Divi Changelog Version 4.27.7.
Workarounds
- Restrict the ability to publish or edit posts using Divi shortcodes to trusted Editor and Administrator roles until the patch is applied
- Deploy a strict Content Security Policy that blocks inline event handlers and unauthorized script sources on pages using the Divi video slider
- Remove or disable the et_pb_video_slider_item shortcode where it is not required for site functionality
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.