Divi legacy dynamic content permits Contributor-level stored cross-site scripting
Divi through 4.27.6 sanitizes only @ET-DC@ dynamic-content markers while its renderer also accepts a legacy JSON form that is converted after save-time filtering. A Contributor or higher can use that legacy form with post_meta_key and enable_html enabled so et_builder_filter_resolve_default_dynamic_content() emits raw post metadata, causing stored script to execute when the page is viewed.
- Component
- Divi
- Plugin slug
divi- Affected
- <= 4.27.6
- Safe version
- See mitigation notes
- Published
- Sep 02, 2026
This CVE was published Sep 02, 2026 and is one of 11 known issues for this theme.
Update, patch or deactivate.
Update to a confirmed release newer than 4.27.6 when available. Until then, restrict untrusted Contributor access or disable affected dynamic-content output when warranted, remove malicious metadata, and invalidate privileged sessions if affected pages were viewed.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the `post_meta_key` resolver in `et_builder_filter_resolve_default_dynamic_content()` does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`, passing raw `get_post_meta()` output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N