The Divi theme for WordPress contains a stored cross‑site scripting vulnerability in the Social Media Follow module. The skype_url shortcode attribute is not properly sanitized and is inserted directly into a link’s href attribute, allowing an attacker with Contributor or higher privileges to inject arbitrary JavaScript. A successful exploit would cause that script to execute in every user’s browser when the link is rendered, providing an attacker with the ability to steal session cookies, deface content, or perform other client‑side attacks. This flaw is catalogued as CWE‑79.

The vulnerability affects Elegant Themes’ Divi theme for WordPress, all releases up to and including version 4.27.6. Users running 4.27.6 or older should review their installation and plan for an upgrade to 4.27.7 or newer.

With a CVSS score of 6.4 the vulnerability is considered medium severity; the EPSS score is not available and it is not listed in CISA’s KEV catalog. Attackers need authenticated Contributor+ access to the WordPress backend and must edit the Social Media Follow shortcode to supply a malicious skype_url. After injection, the payload will run in the context of the site whenever the link is accessed by any visitor. Because it relies on user privileges to inject the payload, an initial compromise or privilege escalation is required before the XSS can be deployed.