Login Request a demo
DI
Product
Divi
by Elegant Themes · last CVE Sep 18, 2026
10
CVEs
0
On KEV
6.4
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 0Medium 10Low 0
Severity
All severities10Critical0High0Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Divi to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-3853
6.4
0%
Sep 5
Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Affected: through 4.27.6
CVE-2026-3852
6.4
0%
Sep 3
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Affected: through 4.27.6
CVE-2026-3850
6.4
0%
Sep 2
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Affected: through 4.27.5
CVE-2026-3851
6.4
0%
Sep 2
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
Affected: through 4.27.6
CVE-2024-5647
6.4
0%
Jul 3
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Affected: through 4.27.1
CVE-2024-4490
6.4
1%
May 10
Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Affected: through 4.25.0
CVE-2024-5533
5.4
0%
Jun 18
Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Affected: through 4.25.1
CVE-2023-6744
5.4
0%
Dec 23
Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Affected: through 4.23.1
CVE-2026-91707
5.3
0%
Sep 18
Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Affected: through 5.11.1
CVE-2026-4361
5.0
0%
Sep 5
Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Affected: through 4.27.6
Showing 10