Divi Builder

Divi Builder has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2025; all 6 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2020 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include Code Injection, Improper Privilege Management.

Every one of the 6 issues recorded for Divi Builder has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Webbernaut.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Divi Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2020-35945

Elegant Themes (Multiple Versions) - Arbitrary File Upload

Read the full analysis

Vulnerability Records

6 records


2025-07-02 00:00	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library Divi Builder <= 4.27.1	`CVE-2024-5647`	6.4 Medium	Webbernaut	Yes
2024-05-09 00:00	Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Divi Builder <= 4.25.0	`CVE-2024-4490`	6.4 Medium	Webbernaut	Yes
2020-08-03 00:00	Elegant Themes (Multiple Versions) - Arbitrary File Upload Divi Builder <= 4.3.2	`CVE-2020-35945`	8.8 High	Chloe Chamberland	Yes
2020-01-04 00:00	Elegant Themes Divi 3.23 - 4.0.9, Divi Extra 2.23 - 4.0.9, Divi Builder 2.23 - 4.0.9 - PHP Code Injection Divi Builder 2.23 – 4.0.9	`N/A`	8.8 High	Elegant Themes Security Team	Yes
2018-10-30 00:00	Elegant Themes (Various Versions) - Stored Cross-Site Scripting Divi Builder <= 2.17.2	`N/A`	6.4 Medium	Anonymous	Yes
2016-02-17 00:00	Elegant Themes Monarch < 1.2.7 - Privilege Escalation Divi Builder <= 1.2.3	`CVE-2016-11004`	8.8 High	James Golovich	Yes

Showing 1–6 of 6 reports