CVE-2026-3852 Elegant Themes CVE debrief

Who should care

WordPress users with the Divi theme installed, particularly those with Contributor-level access and above, should be aware of this vulnerability and take defensive actions to prevent exploitation.

Technical summary

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. The vulnerability is caused by a three-part sanitization failure, allowing authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages. This issue arises because the `skype_url` field is not included in the `$url_options` whitelist in `class-et-builder-element.php`, leading to a lack of `esc_url_raw()` invocation during shortcode processing. Furthermore, the render code in `SocialMediaFollowItem.php` explicitly skips `esc_url()` for Skype URLs, and only `sanitize_text_field()` is applied, which preserves single and double quote characters, enabling attribute breakout. The unsanitized value is directly interpolated into a single-quoted `href` attribute (`href='{$social_network_link_url}'`). Consequently, it is possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user interacts with the injected element. WordPress users with the Divi theme installed should prioritize updating to a patched version to mitigate this vulnerability.

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 6.4 and the potential for authenticated attackers to inject arbitrary web scripts.

Recommended defensive actions

• Apply the vendor's patch or upgrade to a version that addresses this vulnerability.
• Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent cross-site scripting attacks.
• Monitor for suspicious activity and implement exception tracking to identify potential attacks.
• Inventory checks: Verify that the Divi theme version is up-to-date and not vulnerable.
• Restrict Contributor-level access and above to prevent authenticated attackers from injecting arbitrary web scripts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score, affected versions, and potential impact. However, further information about the vendor's remediation efforts and affected scope is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.