Advisories · Technology

Elegant Themes Divi.

Every CVE that names Elegant Themes Divi among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-91707 CVE record

CVSS 5.3 Medium

Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
- Elegant Themes Divi
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-4361 CVE record

CVSS 5.0 Medium

Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
- Elegant Themes Divi
- Server-side request forgery (SSRF)
Not analysed yet 5 Sept 2026
CVE-2026-3853 CVE record

CVSS 6.4 Medium

Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2026
CVE-2026-3852 CVE record

CVSS 6.4 Medium

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-3850 CVE record

CVSS 6.4 Medium

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2026-3851 CVE record

CVSS 6.4 Medium

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2024-5647 CVE record

CVSS 6.4 Medium

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
- BlossomThemes Social Feed
- sayful Carousel Slider
- Cross-site scripting (XSS)
Not analysed yet 3 Jul 2025
CVE-2024-5533 CVE record

CVSS 6.4 Medium

Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Elegant Themes Divi
- CWE-20
Not analysed yet 18 Jun 2024
CVE-2024-4490 CVE record

CVSS 6.4 Medium

Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- Elegant Themes Divi Builder
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 10 May 2024
CVE-2023-6744 CVE record

CVSS 6.4 Medium

Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 23 Dec 2023
CVE-2023-29099 CVE record

CVSS 6.5 Medium

WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS)
- Elegant themes Divi
- Cross-site scripting (XSS)
Not analysed yet 8 Aug 2023