DOM-Based Stored Cross-Site Scripting in Divi Theme by Elegant Themes

CVE-2026-3853

What is CVE-2026-3853?

The Divi theme by Elegant Themes is susceptible to a DOM-based stored cross-site scripting vulnerability, which can be exploited through the image_src attribute of the et_pb_video_slider_item shortcode. This issue arises because the image_src field is absent from the whitelist for URL options, allowing it to be saved without proper sanitization via esc_url_raw(). When rendered, the unsafe image_src value is outputted as a data-image attribute, which undergoes HTML encoding for double quotes but is later decoded by client-side JavaScript, resulting in unescaped HTML injection. Authenticated users with Contributor-level access or higher can leverage this vulnerability to inject malicious scripts, executing them in the context of user interactions with the carousel thumbnails.

References