Security Alert Summary
The Divi theme for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability that affects the Social Media Follow module’s skype_url shortcode attribute in versions up to and including 4.27.6. An authenticated user with Contributor-level access or higher can inject script-bearing content that is stored and may execute when users interact with the affected element.
CVE Details
- CVE ID: CVE-2026-3852
- Affected component: Divi theme for WordPress (Social Media Follow module)
- Affected versions: All versions up to and including 4.27.6
- Published: September 3, 2026 at 1:05:38 PM UTC
- Last modified: September 3, 2026 at 2:17:00 PM UTC
- CVSS v3.1: Base Score 6.4, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Network attack vector; low privileges required (e.g., Contributor-level); no user interaction required
- Primary impact: Confidentiality – LOW; Integrity – LOW; Availability – NONE
- Weakness: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored XSS rooted in a three-part sanitization failure around the skype_url attribute of the Social Media Follow module. The reported issues are:
skype_urlis not included in the$url_optionswhitelist inclass-et-builder-element.php, so it does not get passed throughesc_url_raw()during shortcode processing.- The render code in
SocialMediaFollowItem.phpexplicitly skipsesc_url()for Skype URLs using a conditional (! $is_skype ? esc_url( $url ) : $skype_url), leaving the Skype value unescaped. - Only
sanitize_text_field()is applied to the Skype value, which preserves single and double quote characters and allows attribute breakout. The unsanitized value is interpolated into a single-quotedhrefattribute (href='{$social_network_link_url}'), enabling injection of arbitrary HTML/JavaScript.
As documented, authenticated users with Contributor-level access or higher can store malicious input that will be rendered into page markup and may execute when a user interacts with the injected element. The impact is limited to the ability to run script in the context of affected pages and the data those pages can access, consistent with the CVSS impacts listed above.
How This Could Impact Your Website
Consider a small team running a WordPress site using Divi: the site owner, internal staff who publish content, and an external contractor or contributor who adds or edits social links. If a contributor adds a specially crafted skype_url value via the Social Media Follow module, that value can be stored in the site content and later rendered into page markup without proper escaping. When other users interact with the affected element, injected scripts can run in their browsers.
Practical consequences include exposure of information accessible to a visiting user’s browser (for example, session-exposed or page-level data), and an increased risk of targeted phishing or social engineering against staff members whose browsers execute the injected scripts. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected Divi theme as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site activity and logs for unusual behavior or unexpected content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
