CVE-2026-3851 Elegant Themes CVE debrief

Who should care

Users of the Divi theme for WordPress, particularly those with Contributor-level access or above, should be aware of this vulnerability and take steps to mitigate it. The vulnerability affects the Dynamic Content feature in versions up to and including 4.27.6 of the Divi theme. Affected operators must assess their exposure and implement necessary security measures. Platform administrators should review and apply vendor guidance. Vulnerability management and security teams should prioritize patching and monitoring for potential exploitation attempts. This involves verifying the presence of affected Divi theme versions, restricting access to the Dynamic Content feature, and enhancing monitoring and detection capabilities for suspicious activities related to the vulnerability. Additionally, operators should consider compensating controls for exposed systems while remediation is in progress and verify the effectiveness of implemented security measures. Asset inventory management is crucial to ensure that all instances of the Divi theme are accounted for and remediated. Implementing rollback/change windows and source tracking can further enhance the security posture against this vulnerability. Regular reviews of security logs and timely response to potential incidents are essential components of a comprehensive mitigation strategy. By taking these steps, organizations can reduce the risk associated with this Stored Cross-Site Scripting vulnerability in the Divi theme for WordPress. This requires a coordinated effort across IT operations, security teams, and management to ensure effective mitigation and minimize potential impact. The vulnerability's resolution involves both technical measures and operational vigilance to prevent exploitation and protect against potential threats. Therefore, a proactive and thorough approach to addressing this vulnerability is recommended to safeguard against potential attacks and maintain the security integrity of affected systems. This approach should be aligned with best practices for vulnerability management and incident response to ensure a robust defense against evolving cyber threats. In conclusion, a comprehensive and multi-fac

Technical summary

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the `post_meta_key` resolver in `et_builder_filter_resolve_default_dynamic_content()` does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`, passing raw `get_post_meta()` output directly to the page.

Defensive priority

Authenticated attackers with Contributor-level access can inject web scripts via the Divi theme's Dynamic Content feature.

Recommended defensive actions

• Apply the vendor's remediation for the Divi theme.
• Restrict access to the Dynamic Content feature to authorized users only.
• Monitor for suspicious activity related to the Dynamic Content feature.
• Consider implementing additional security controls, such as web application firewalls or intrusion detection systems.
• Perform an inventory of systems using the Divi theme to identify potential exposure.
• Implement rollback/change windows for affected systems to ensure timely remediation.
• Track changes to the Divi theme and monitor for potential security updates.

Evidence notes

The vulnerability exists in the Divi theme for WordPress, specifically in the Dynamic Content feature's legacy JSON format. Two compounding flaws allow for Stored Cross-Site Scripting: (1) the save-time sanitization filter only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that bypasses the filter, and (2) the `post_meta_key` resolver does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.