WordPress RW Divi Unite Gallery plugin <= 1.0 - Security Bypass vulnerability via Outdated Freemius

Security Bypass vulnerability via Outdated Freemius discovered by 0xdecafbad in WordPress RW Divi Unite Gallery plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of January 24, 2022 and is not available for download. This closure is temporary, pending a full...

RW Divi Unite Gallery <= 1.0 - Security Bypass via Outdated Freemius

The plugin is vulnerable to a security bypass due to the use of a known vulnerable component, Freemius 2.2.4. The plugin uses Freemius 1.0.0 and is therefore vulnerable. The core issue that causes the vulnerability is in the setdboption function, which is exposed to any authenticated user with no...

CVE-2020-35945

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...

CVE-2020-35945

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...

Design/Logic Flaw

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...

CVE-2020-35945

The Divi Builder plugin, Divi theme, and Divi Extra theme for WordPress are vulnerable to an authenticated arbitrary file upload before version 4.5.3 . The root cause is that file extension checks are performed exclusively on the client side, allowing attackers with contributor-level privileges o...

CVE-2020-35945: Unrestricted Upload of File with Dangerous Type

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...

PT-2021-11877

Name of the Vulnerable Software and Affected Versions: Divi Builder plugin versions prior to 4.5.3 Divi theme versions prior to 4.5.3 Divi Extra theme versions prior to 4.5.3 Description: An issue allows authenticated attackers with contributor-level or above capabilities to upload arbitrary file...

WordPress Elegant Themes Divi Theme 3.0 <= 4.5.2 Authenticated Arbitrary File Upload Vulnerability

The WordPress theme Divi by Elegant Themes is prone to an authenticated arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

WordPress Divi Builder plugin <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Divi Builder plugin versions = 4.5.2. Solution Update the WordPress Divi Builder plugin to the latest available version at least 4.5.3...

Elegant Themes (Divi 3.0 - 4.5.2, Extra 2.0 - 4.5.2, Divi Builder 2.0 - 4.5.2) - Authenticated Arbitrary File Upload

Description This flaw gave authenticated attackers, with contributor-level or above capabilities, the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. Usage: php poc.php url username password filetoupload Once the file is...

Elegant Themes (Divi 3.0 - 4.5.2, Extra 2.0 - 4.5.2, Divi Builder 2.0 - 4.5.2) - Authenticated Arbitrary File Upload

Description This flaw gave authenticated attackers, with contributor-level or above capabilities, the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. PoC Usage: php poc.php url username password filetoupload Once the file is...

WordPress Divi premium theme <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Divi premium theme versions = 4.5.2. Solution Update the WordPress Divi premium theme to the latest available version at least 4.5.3...

VulnCheck KEV: CVE-2020-35945

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...

Divi Resource Management Error Vulnerability

Divi is a digital currency. A security vulnerability exists in Divi 4.0.5 and earlier versions. An attacker could exploit the vulnerability to cause a denial of service...

Divi Resource Management Error Vulnerability

Divi is a digital currency. A security vulnerability exists in Divi 4.0.5 and earlier versions. An attacker could exploit the vulnerability to cause a denial of service...

WordPress Divi premium theme <= 4.0.9 - Authenticated Code Injection

Authenticated Code Injection vulnerability found in WordPress Divi premium theme versions = 4.0.9. Solution Update the WordPress Divi premium theme to the latest available version at least 4.0.10...

WordPress Divi Builder plugin <= 4.0.9 - Authenticated Code Injection vulnerability

Authenticated Code Injection vulnerability found in WordPress Divi Builder plugin versions = 4.0.9. Solution Update the WordPress Divi Builder plugin to the latest available version at least 4.0.10...

ElegantThemes (Divi, Extra, divi-builder < 4.0.10) - Authenticated Code Injection

Description "A code injection vulnerability was discovered by our team during a routine code audit that could allow logged in contributors, authors and editors to execute a small set of PHP functions." Affected: Divi version 3.23 and above, Extra 2.23 and above Divi Builder version 2.23 and above...

CVE-2018-19162

Divi through 4.0.5 a chain-based proof-of-stake cryptocurrency allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk...