CVE-2026-3852

Name of the Vulnerable Software and Affected Versions Divi theme for WordPress versions prior to 4.27.7

Description Stored Cross-Site Scripting occurs via the skype url shortcode attribute of the Social Media Follow module. The issue stems from a three-part sanitization failure: the skype url field is missing from the $url options whitelist in class-et-builder-element.php, preventing the use of esc url raw() during shortcode processing; the render code in SocialMediaFollowItem.php explicitly bypasses esc url() for Skype URLs; and the use of sanitize text field() allows single and double quote characters to persist. Consequently, the unsanitized value is inserted directly into a single-quoted href attribute, enabling authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user interacts with the element.

Recommendations Update to version 4.27.7 or later. As a temporary workaround, restrict the use of the skype url attribute within the Social Media Follow module.