Divi contributors can store script in Skype social links
Divi through 4.27.6 does not apply URL validation or attribute-context escaping to the Social Media Follow module's skype_url shortcode attribute. A Contributor or higher can break out of the generated href attribute and store script that executes when a visitor interacts with the affected social link.
- Component
- Divi
- Plugin slug
divi- Affected
- <= 4.27.6
- Safe version
4.27.7- Published
- Sep 03, 2026
This CVE was published Sep 03, 2026 and is one of 11 known issues for this theme.
Update, patch or deactivate.
Update to 4.27.7 or later, remove untrusted Skype social-link values, and review activity after affected links were opened.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: (1) the `skype_url` field is not included in the `$url_options` whitelist in `class-et-builder-element.php`, so it never invokes `esc_url_raw()` during shortcode processing, (2) the render code in `SocialMediaFollowItem.php` explicitly skips `esc_url()` for Skype URLs (`! $is_skype ? esc_url( $url ) : $skype_url`), and (3) only `sanitize_text_field()` is applied, which preserves single and double quote characters allowing attribute breakout. The unsanitized value is interpolated directly into a single-quoted `href` attribute (`href='{$social_network_link_url}'`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user interacts with the injected element.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N