477 matches found
EUVD-2026-96298
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...
CVE-2026-91136 Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...
CVE-2026-91136
The Divi Plus WordPress plugin (versions ≤ 2.4.0 ) is vulnerable to Unauthenticated Arbitrary File Read due to a lack of input validation on the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The SVGAnimatorController::index_permission callback returns true...
CVE-2026-91136 Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...
CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...
PT-2026-109616
Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1 Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permissi...
WordPress Divi Plus plugin <= 2.4.0 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by ShinThink in WordPress Plugin Divi Plus versions = 2.4.0...
VulnCheck KEV: CVE-2026-91136
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...
CVE-2026-39725
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829...
EUVD-2026-93247
Contributor Remote Code Execution RCE in Content Visibility for Divi Builder = 5.03 versions...
CVE-2026-39725
The Content Visibility for Divi Builder WordPress plugin, versions
CVE-2026-39725
...
PT-2026-106412
Name of the Vulnerable Software and Affected Versions Content Visibility for Divi Builder versions prior to 5.04 Description A flaw allows a user with Contributor privileges to achieve Remote Code Execution RCE, which is the ability to execute arbitrary commands on the host server. Recommendation...
CVE-2026-39725: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829...
WordPress Content Visibility for Divi Builder plugin <= 5.03 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by ParkHyunWoo in WordPress Plugin Content Visibility for Divi Builder versions = 5.03...
CVE-2026-19652
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmemformsubmithandler function determining the new user's role by iterating all WordPress roles and calling passwordverify against an attacker-controlled bcry...
CVE-2026-19652 Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmemformsubmithandler function determining the new user's role by iterating all WordPress roles and calling passwordverify against an attacker-controlled bcry...
EUVD-2026-91635
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmemformsubmithandler function determining the new user's role by iterating all WordPress roles and calling passwordverify against an attacker-controlled bcry...
CVE-2026-19652
The Divi Membership plugin for WordPress (versions up to and including 2.2.0 ) is vulnerable to unauthenticated privilege escalation via the form_id parameter. The root cause lies in the dmem_form_submit_handler() function, which determines a new user's role by iterating through all WordPress rol...