Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Divi — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in Divi, with AI-generated Chinese analysis, references, and POCs.

Vendor: Elegant themes

CVE ID Title CVSS Severity Published
CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint CWE-862 5.3 Medium 2026-09-18
CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter CWE-79 6.4 Medium 2026-09-05
CVE-2026-4361 Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter CWE-918 5.0 Medium 2026-09-05
CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter CWE-79 6.4 Medium 2026-09-03
CVE-2026-3850 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter CWE-79 6.4 Medium 2026-09-02
CVE-2026-3851 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode CWE-79 6.4 Medium 2026-09-02
CVE-2026-13712 Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL - - 2026-08-16
CVE-2024-5533 Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-20 6.4 Medium 2024-06-18
CVE-2023-6744 Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium 2023-12-23
CVE-2023-29099 WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS) CWE-79 6.5 Medium 2023-08-08

All 10 known CVE vulnerabilities affecting Divi with full Chinese analysis, references, and POCs where available.