The Divi theme contains a DOM‑Based Stored XSS flaw in the image_src attribute of the et_pb_video_slider_item shortcode. Because the field is not whitelisted, it bypasses server side escaping and can be stored with malicious payloads. When a visitor hovers over the carousel thumbnail the serialized value is decoded by JavaScript and concatenated into the DOM without re‑escaping, allowing injected scripts to execute. This enables an authenticated contributor or higher to inject arbitrary JavaScript that runs in the context of any page that contains the carousel, exposing users to data theft or further exploitation.

Elegant Themes Divi for WordPress, versions 4.27.6 and earlier.

The flaw carries a CVSS score of 6.4, indicating a moderate severity. The EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor access or higher, so based on the description, it is inferred that the attacker must first obtain legitimate credentials or leverage social engineering to create a contributor account. Once authenticated, the attacker can edit a page and insert a malicious payload into the image_src attribute; the script will run for any user that loads the page and hovers over the carousel thumbnail. Although the need for authentication reduces the likelihood of widespread exploitation, the impact on confidentiality, integrity, and availability is significant for the affected organization.