EElegant Themes

Products

Exploited and recent CVEs

• CVE-2026-91707 Medium 5.3 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint 0.5%
• CVE-2026-4361 Medium 5.0 Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter 0.4%
• CVE-2026-3853 Medium 6.4 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter 0.3%
• CVE-2026-3852 Medium 6.4 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter 0.3%
• CVE-2026-3850 Medium 6.4 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter 0.3%
• CVE-2026-3851 Medium 6.4 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode 0.3%
• CVE-2024-5647 Medium 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library 0.4%
• CVE-2024-5647 Medium 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library 0.4%
• CVE-2024-5647 Medium 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library 0.4%
• CVE-2024-5533 Medium 6.4 Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-4490 Medium 6.4 Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.5%
• CVE-2024-4490 Medium 6.4 Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.5%
• CVE-2024-4490 Medium 6.4 Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.5%
• CVE-2023-6744 Medium 6.4 Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2023-29099 Medium 6.5 WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS) 0.4%