CyberRota Analysis
AI-GeneratedThe Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) through the `skype_url` shortcode attribute in the Social Media Follow module, affecting all versions up to 4.27.6. This vulnerability arises from inadequate sanitization, allowing authenticated attackers with Contributor-level access or higher to inject malicious scripts that execute when users interact with the compromised elements. WordPress site administrators using the Divi theme should prioritize this issue to protect against potential exploitation and user data compromise.
Original NVD Description
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: (1) the `skype_url` field is not included in the `$url_options` whitelist in `class-et-builder-element.php`, so it never invokes `esc_url_raw()` during shortcode processing, (2) the render code in `SocialMediaFollowItem.php` explicitly skips `esc_url()` for Skype URLs (`! $is_skype ? esc_url( $url ) : $skype_url`), and (3) only `sanitize_text_field()` is applied, which preserves single and double quote characters allowing attribute breakout. The unsanitized value is interpolated directly into a single-quoted `href` attribute (`href='{$social_network_link_url}'`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user interacts with the injected element.