Skip to content
OpenAdvisories

Vendor

Divi Essential

2 known vulnerabilities.

Products

Divi Plus 1 Divi Essentials 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-91136 Public exploit

    Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

    The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback …

    Divi Essential Divi Plus Web / CMS