Elegant Themes Divi
10 CVEs affecting Elegant Themes Divi. Latest disclosed: 2026-09-05. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29099 | Medium | 6.5 | 2023-08-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Elegant themes Divi theme <= 4.20.2 versions. |
CVE-2026-3853 | Medium | 6.4 | 2026-09-05 | The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in… |
CVE-2026-3852 | Medium | 6.4 | 2026-09-03 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all vers… |
CVE-2026-3850 | Medium | 6.4 | 2026-09-02 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all version… |
CVE-2026-3851 | Medium | 6.4 | 2026-09-02 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and inclu… |
CVE-2024-5647 | Medium | 6.4 | 2025-07-03 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versio… |
CVE-2024-5533 | Medium | 6.4 | 2024-06-18 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization a… |
CVE-2024-4490 | Medium | 6.4 | 2024-05-14 | The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’… |
CVE-2023-6744 | Medium | 6.4 | 2023-12-23 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1… |
CVE-2026-4361 | Medium | 5.0 | 2026-09-05 | The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oem… |