Content Visibility for Divi Builder

Content Visibility for Divi Builder has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; 2 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Code Injection, behind 3 of the records (100%).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, most of them (2) reported by ZAST.AI. Content Visibility for Divi Builder is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all Content Visibility for Divi Builder vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2026-39725

Content Visibility for Divi Builder <= 5.03 - Authenticated (Contributor+) Remote Code Execution

Read the full analysis

Vulnerability Records

3 records
Content Visibility for Divi Builder banner
Latestv5.03

Content Visibility for Divi Builder

Jonathan Horowitz

Author

Jonathan Horowitz

4.8(101)
96/100
Last Updated
2026-10-06 (13d ago)
Active Installs
2,000+
Downloads
77,749
Requires WP
5.5+
Requires PHP
7.0+
Tested up to
WP 7.0.7
Created
2016-02-28 (11y ago)

Content Visibility for Divi Builder allows Sections and Modules to be displayed/hidden based on the outcome of a PHP boolean expression. This plugin is for both the standalone Divi theme (or child themes thereof) and the Divi Builder plugin, version 3 or higher! Developer Filters Expression Validation Filters The following filters allow developers to customize expression validation behavior. Add these filters in your theme’s functions.php or in a custom plugin. content_visibility_for_divi_builder_blocked_functions Filter the array of blocked function names. Functions in this list will cause an expression to fail validation. All comparisons are case-insensitive. Example – allow file_get_contents (blocked by default): add_filter( 'content_visibility_for_divi_builder_blocked_functions', function( $functions ) { return array_diff( $functions, array( 'file_get_contents' ) ); } ); Example – block an additional function: add_filter( 'content_visibility_for_divi_builder_blocked_functions', function( $functions ) { $functions[] = 'my_dangerous_function'; return $functions; } ); content_visibility_for_divi_builder_allowed_tokens Filter the array of allowed PHP token types (T_* constants). Tokens not in this list will cause an expression to fail validation. This is an advanced filter – consult the PHP tokenizer documentation before modifying. Example – allow the T_VARIABLE token type (blocked by default, use with caution): add_filter( 'content_visibility_for_divi_builder_allowed_tokens', function( $tokens ) { $tokens[] = T_VARIABLE; return $tokens; } ); content_visibility_for_divi_builder_allowed_chars Filter the array of allowed single-character tokens. Characters not in this list (such as =, ;, {, }, `, @, &, |, ~, ^) will cause an expression to fail validation. Example – allow the & character for bitwise operations: add_filter( 'content_visibility_for_divi_builder_allowed_chars', function( $chars ) { $chars[] = '&'; return $chars; } ); content_visibility_for_divi_builder_allowed_callables Filter the array of callables (function names and Class::method static-method entries) the validator considers known-safe. Anything not on the allowlist (and not on the blocked_functions denylist) is treated as an “Unknown callable” error. Names are normalized (leading \ stripped, namespace\ keyword prefix stripped, lowercased) before comparison, so \My\Namespace\Class::method, My\Namespace\Class::method, and namespace\My\Namespace\Class::method all match the same allowlist entry. The default list ships with WordPress conditional tags (is_user_logged_in, current_user_can, is_admin, etc.). The Expression Validation tab’s content scanner generates a ready-to-paste snippet for this filter pre-populated with every custom callable currently in your content. Example – allowlist a theme helper and a static service method: add_filter( 'content_visibility_for_divi_builder_allowed_callables', function( $callables ) { $callables[] = 'mytheme_should_be_visible'; $callables[] = 'MyTheme\Visibility\Service::checkUser'; return $callables; } );

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C