Divi

Divi has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 10 of the records (71%). Other recurring categories include Code Injection, Improper Input Validation.

Every one of the 14 issues recorded for Divi has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (5) reported by Osvaldo Noe Gonzalez Del Rio (Os).

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Divi vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2020-35945

Elegant Themes (Multiple Versions) - Arbitrary File Upload

Read the full analysis

Vulnerability Records

14 records


2026-09-04 18:15	Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3853`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 18:13	Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter Divi <= 4.27.6	`CVE-2026-4361`	5.0 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-02 19:51	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3852`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-01 17:38	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter Divi <= 4.27.5	`CVE-2026-3850`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-01 14:46	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode Divi <= 4.27.6	`CVE-2026-3851`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-08-14 00:00	Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Divi 5.0 – 5.8.1	`CVE-2026-13712`	6.4 Medium	.$n	Yes
2025-07-02 00:00	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library Divi <= 4.27.1	`CVE-2024-5647`	6.4 Medium	Webbernaut	Yes
2024-06-17 19:31	Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Divi <= 4.25.1	`CVE-2024-5533`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes
2024-05-09 00:00	Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Divi <= 4.25.0	`CVE-2024-4490`	6.4 Medium	Webbernaut	Yes
2023-12-22 00:00	Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Divi <= 4.23.1	`CVE-2023-6744`	6.4 Medium	Francesco Carlucci	Yes

Showing 1–10 of 14 reports