THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-3853 (MEDIUM 6.4) — The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options`

[NVD] CVE-2026-3853 (MEDIUM 6.4) — The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options`

mednvdPublished 2026-09-05

CVE-2026-3853 CVSS: 6.4 MEDIUM Published: 2026-09-05T07:17:11.803

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`,

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-3853cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-3853