Divi Version 4.27.7 Changelog

– Security Update: Fixed a stored XSS risk in Social Media Follow Skype URL handling by applying consistent URL escaping at render time. Props to Osvaldo Noe Gonzalez Del Rio (Os) for the responsible disclosure.
– Security Update: Fixed an issue in D4 Contact Form redirects by blocking unsafe redirect URL schemes and enforcing URL-safe handling of redirect_url. Props to Osvaldo Noe Gonzalez Del Rio (Os) for the responsible disclosure.
– Security Update: Fixed an issue where legacy Dynamic Content JSON could keep raw HTML enabled for users without unfiltered_html. Props to Osvaldo Noe Gonzalez Del Rio (Os) for the responsible disclosure.
– Security Update: Fixed a blind SSRF vector in Divi 4 video thumbnail resolution checks by enforcing safe outbound HTTP requests. Props to Osvaldo Noe Gonzalez Del Rio (Os) for the responsible disclosure.
– Security Update: Fixed a stored XSS vulnerability that made it possible for users with Contributor role or above to insert JavaScript code onto the page via the Video Slider module’s shortcode. Props to Osvaldo Noe Gonzalez Del Rio (Os) for the responsible disclosure.