CVE-2026-3850 Elegant Themes CVE debrief

Who should care

Users of the Divi theme for WordPress, particularly those with Contributor-level access or higher, should be aware of this vulnerability and take steps to mitigate it. This includes applying vendor patches or upgrades to versions beyond 4.27.6, restricting access to the contact form to trusted users, and monitoring for suspicious form submissions and injected scripts. Additionally, operators of WordPress platforms, vulnerability management teams, and security teams should review the vulnerability details to assess their exposure and plan appropriate mitigations. This may involve verifying that affected product deployments exist in managed environments, reviewing compensating controls for exposed systems, and tracking exceptions and retesting remediated assets. The vulnerability's impact on operational security and the potential for exploitation should be carefully evaluated to ensure adequate protection of sensitive assets and data. Security teams should also consider the source-confidence limits of the vulnerability information and review the context in which the vulnerability was discovered and reported. By taking these steps, organizations can reduce their risk exposure and protect against potential attacks leveraging this vulnerability. The vulnerability's classification as a Stored Cross-Site Scripting attack highlights the importance of robust input sanitization and output encoding practices in web application development. Therefore, it is essential for affected organizations to prioritize the application of patches or mitigations and to maintain vigilance in monitoring their systems for signs of exploitation. This may involve enhancing monitoring, detection, and logging capabilities to quickly identify and respond to potential security incidents related to this vulnerability. Overall, a comprehensive approach to vulnerability management, including prompt patching, access control, and ongoing monitoring, is crucial for mitigating the risks associated with this vulnerability in the Divi theme for WordPress. The potential operational impact of this vulnerability should not be underestimated, as successful exploitation could lead to unauthorized script-inject

Technical summary

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, and including, 4.27.6. This is due to the `redirect_url` attribute being sanitized with `esc_attr()` instead of `esc_url()` before being rendered into the `data-redirect_url` HTML data attribute. Additionally, `redirect_url` is absent from the hardcoded `$url_options` array in `class-et-builder-element.php`, so it does not receive `esc_url_raw()` sanitization during shortcode parsing. After a successful form submission, client-side JavaScript reads this data attribute and passes it directly to `window.location.href`, executing arbitrary JavaScript from a `javascript:` URI. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user submits the contact form.

Defensive priority

Authenticated attackers with Contributor-level access could inject web scripts via the Divi theme's contact form, allowing for Stored Cross-Site Scripting attacks.

Recommended defensive actions

• Apply vendor patch or upgrade to a version beyond 4.27.6
• Restrict access to the contact form to trusted users
• Monitor for suspicious form submissions and injected scripts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode. The `redirect_url` attribute is sanitized with `esc_attr()` instead of `esc_url()` and lacks `esc_url_raw()` sanitization during shortcode parsing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.