The Divi theme for WordPress contains a stored XSS flaw that originates from the redirect_url attribute of the et_pb_contact_form shortcode. Because the attribute is sanitized with esc_attr() instead of esc_url() and is not included in the list of securely escaped options, the attribute value ends up rendered directly into a data attribute. After a form submission, client‑side JavaScript copies that data attribute into window.location.href, allowing an authenticated user with Contributor-level access or higher to inject arbitrary JavaScript via a javascript: URI. This injection can occur on any page that hosts the shortcode and will be executed whenever a visitor submits the form, compromising confidentiality, integrity, or availability of the web session.

Elegant Themes Divi theme for WordPress is affected in all versions up to and including 4.27.6. Users running any of those releases that include the contact form shortcode are vulnerable unless they have already applied a later patch.

The vulnerability scores a CVSS of 6.4, indicating a moderate severity. No EPSS value is provided, so current exploitation statistics are unknown. The flaw is available to authenticated users with Contributor or higher roles, making the attack vector local and role‑based. Once exploited, the attacker can execute scripts in the context of any site visitor, leading to session hijacking, cookie theft, or defacement. The vulnerability is not listed in the CISA KEV catalog at present.