CVE-2026-3850

Name of the Vulnerable Software and Affected Versions Divi versions prior to 4.27.7

Description The Divi theme for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occurs because the redirect url parameter of the et pb contact form shortcode is sanitized using esc attr() instead of esc url() before being rendered into the data-redirect url HTML data attribute. Furthermore, the redirect url is missing from the $url options array in class-et-builder-element.php, bypassing esc url raw() sanitization during shortcode parsing. When a user submits the contact form, client-side JavaScript reads the attribute and passes it to window.location.href, allowing the execution of arbitrary JavaScript via a javascript: URI.

Recommendations Update to a version newer than 4.27.6. As a temporary workaround, avoid using the redirect url parameter in the et pb contact form shortcode.