What’s Vulnerable › Products

Elegant Themes Divi vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Elegant Themes Divi version is affected

Latest Elegant Themes Divi vulnerabilities

• CVE-2026-91707 — Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint (CVSS 5.3)
• CVE-2026-4361 — Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter (CVSS 5.0)
• CVE-2026-3853 — Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter (CVSS 6.4)
• CVE-2026-3852 — Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter (CVSS 6.4)
• CVE-2026-3850 — Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter (CVSS 6.4)
• CVE-2026-3851 — Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode (CVSS 6.4)
• CVE-2024-5647 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4)
• CVE-2024-5533 — Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-4490 — Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2023-6744 — Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2023-29099 — WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
• CVE-2020-35945 — (CVSS 8.8)
• CVE-2015-1579 — (CVSS 5.0)