https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 22:23:34 +0000 https://db.gcve.eu/vuln/cve-2026-3853 <p><strong>Affected:</strong> Elegant Themes Divi</p> <p>The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `&amp;quot;`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery&#39;s `.data(&#39;image&#39;)`, which returns the browser-decoded value (with `&amp;quot;` decoded back to `&#34;`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.</p> <p><strong>Affected:</strong> Elegant Themes Divi</p> <p>The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `&amp;quot;`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery&#39;s `.data(&#39;image&#39;)`, which returns the browser-decoded value (with `&amp;quot;` decoded back to `&#34;`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.</p> https://db.gcve.eu/vuln/cve-2026-3853