Elegant Themes Divi

Divi through 4.27.6 uses wp_remote_get() in et_pb_set_video_oembed_thumbnail_resolution() to fetch a Contributor-controlled image URL without blocking private or reserved destinations. The response body is not returned, but differences in the returned URL and request timing provide status and reachability oracles for internal targets.

Divi through 4.27.6 does not treat the et_pb_video_slider_item image_src attribute as a URL during save-time validation. Although the server escapes it into data-image, the carousel browser-decodes the value and concatenates it into new HTML through jQuery.after() without re-escaping. A Contributor can store script that executes when a visitor hovers over the carousel thumbnail.

Divi through 4.27.6 does not apply URL validation or attribute-context escaping to the Social Media Follow module's skype_url shortcode attribute. A Contributor or higher can break out of the generated href attribute and store script that executes when a visitor interacts with the affected social link.

Divi's contact-form shortcode handles redirect_url with attribute escaping instead of URL-scheme validation and omits it from the builder's URL-option sanitization. A Contributor can store a javascript: redirect that executes when a visitor successfully submits the affected form. The authoritative description says versions through 4.27.6 are affected, while its structured affected range ends at 4.27.5.

Divi through 4.27.6 sanitizes only @ET-DC@ dynamic-content markers while its renderer also accepts a legacy JSON form that is converted after save-time filtering. A Contributor or higher can use that legacy form with post_meta_key and enable_html enabled so et_builder_filter_resolve_default_dynamic_content() emits raw post metadata, causing stored script to execute when the page is viewed.

Divi is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is 5.0 to < 5.9.0.

Divi is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Divi is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Divi is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Divi is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Elegant Themes Divi is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.