CVE-2026-3853 Elegant Themes CVE debrief

Who should care

WordPress administrators and users of the Divi theme, particularly those with Contributor-level access and above, should assess exposure and prioritize updating to version 4.27.7 or later.

Why it matters

The Divi theme for WordPress has a DOM-Based Stored Cross-Site Scripting vulnerability, allowing authenticated attackers to inject arbitrary web scripts. WordPress administrators and users of the Divi theme should assess exposure and prioritize updating to version 4.27.7 or later.

• Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.
• Successful exploitation requires user interaction, as the script only executes when a user hovers over the carousel thumbnail.
• The vulnerability has a CVSS score of 6.4 and a CVSS severity of MEDIUM.
• Remediation priority is medium, as updating to version 4.27.7 or later will address the vulnerability.

Technical summary

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist, so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping.

Defensive priority

Medium

Recommended defensive actions

• Update to version 4.27.7 or later
• Review and modify the `$url_options` whitelist to include `image_src`
• Implement additional input validation and output encoding for user-supplied data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists due to the `image_src` field not being included in the `$url_options` whitelist, leading to a lack of proper escaping. The client-side JavaScript carousel code reads the `data-image` attribute and concatenates it into an HTML string without re-escaping, allowing for arbitrary web script injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.