CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder Ein verstecktes Feld. Ein geänderter Wert. Vollzugriff auf die gesamte Website. 🧨 Was kann ein Angreifer tun? 🔬 Schwachstellenanalyse Schwachstellenort root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser Angreifbarer Code root@kitploit:...

CVE-2026-5118

CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...

CVE-2026-5118

Divi Form Builder ⚠️ AVVERTENZA: Questo strumento è destinato esclusivamente a test di penetrazione autorizzati e ricerca sulla sicurezza. L'accesso non autorizzato a sistemi informatici è illegale. Utilizzalo solo su sistemi di tua proprietà o per i quali hai ricevuto esplicito permesso scritto...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Schwachstelleninformationen Feld| Details ---|--- CVE-ID| CVE-2026-5118 CVSS-Score| 9.8 Kritisch CVSS-Vektor| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Nicht authentifizierte Privilegienausweitung durch Rolleninjektion 🔥 Zusammenfassung der Sicherheitslücke Das WordPress-Plugin Divi Form Builder in Versionen = 5.1.2 ist anfällig für eine nicht authentifizierte Privilegienausweitung. Dieser kritische...

CVE-2026-5524-PoC

CVE-2026-5524 — Nicht authentifizierte RCE im Divi Form Builder Massives Exploit-Toolkit für CVE-2026-5524 , eine nicht authentifizierte Schwachstelle zum Hochladen beliebiger Dateien im WordPress-Plugin Divi Form Builder = 5.1.8, die zu Remote-Code-Ausführung führt...

CVE-2026-PoCs

CVE-2026-PoCs 2026 में प्रकट किए गए CVEs के लिए समुदाय-निर्मित, सत्यापित Proof-of-Concept एक्सप्लॉइट्स का संग्रह। यह रेपो क्यों अधिकांश CVE PoC संग्रह Twitter थ्रेड्स, gists और मृत ब्लॉग लिंक्स पर बिखरे हुए हैं। यह रेपो 2026 के CVE PoCs का एकल, सुव्यवस्थित, सक्रिय रूप से अनुरक्षित सूचकांक बनने का...

WordPress Divi theme 5.0-5.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ,.$n.,Sico.eX in WordPress Theme Divi versions 5.0-5.8.1...

CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

CVE-2026-13712 Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

EUVD-2026-59909

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

CVE-2026-13712

Divi WordPress theme versions 5.0 through 5.8.1 is vulnerable to contributor-level stored XSS via the Social Media Follow module's Skype URL field; malicious JavaScript stored by a low-privileged user executes when an administrator views the post. CVSS 5.4 medium. Patch to version 5.9.0. No in-th...

EUVD-2026-51762

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-12978

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

CVE-2026-12978

The CVE-2026-12978 entry affects the FunnelKit WordPress plugin prior to version 3.15.0.6. Affected component: page-builder AJAX action used when the Divi builder is active. Root cause: user-supplied parameter is not escaped before being reflected into the HTML response, enabling a Reflected XSS ...

CVE-2026-12978 FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

CVE-2026-12978

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

EUVD-2026-44881

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

CVE-2026-57420

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through = 2.1.5...