CVE-2026-3853

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853

The Divi theme for WordPress (versions ≤ 4.27.6 ) is affected by a DOM-Based Stored Cross-Site Scripting vulnerability in the image_src attribute of the et_pb_video_slider_item shortcode. The root cause is that image_src is absent from the $url_options whitelist, so it never receives esc_url_raw(...

CVE-2026-3853: Improper Neutralization of Input During Web Page Generation

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

PT-2026-86328

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image src attribute of the et pb video slider item shortcode in all versions up to, and including, 4.27.6. This is due to the image src field not being included in the $url options whitelist which only...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Video Slider 'imagesrc' Shortcode Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...

CVE-2026-27086

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

CVE-2026-27086

CVE-2026-27086 affects the WordPress WoodMart theme by Xtemos , versions before 8.3.8 . The vulnerability is a DOM-Based Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.5 (Medium) , with a changed scope and low impact on co...

CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

EUVD-2026-70980

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

CVE-2026-27086: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

Divi < 4.27.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

Description The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which onl...

PT-2026-85448

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

CVE-2026-85302

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

EUVD-2026-70559

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

CVE-2026-85302 WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

CVE-2026-85302

A DOM-Based XSS vulnerability exists in the WPKoi Templates for Elementor WordPress plugin, affecting versions from n/a through 3.7.2 . The flaw stems from improper neutralization of input during web page generation. Exploitation requires low privileges and user interaction , with a changed scope...