Thème WordPress
Vulnérabilités Divi
Cette page rassemble les failles publiées pour Divi, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Divi
8 fiches
Multiple Plugins <= (Various Versions) – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-4.27.1
4.27.2
02/07/2025
Divi <= 4.25.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and…
*-4.25.1
4.25.2
17/06/2024
Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ parameter in versions up to, and including, 4.25.0 due to insufficient input sanitization and…
*-4.25.0
4.25.1
09/05/2024
Divi <= 4.23.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on user supplied custom field data.…
*-4.23.1
4.23.2
22/12/2023
Divi <= 4.20.2 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.20.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-4.20.2
4.20.3
09/05/2023
Elegant Themes (Multiple Versions) – Arbitrary File Upload
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check…
*-4.3.2
4.5.3
03/08/2020
Elegant Themes Divi 3.23 – 4.0.9, Divi Extra 2.23 – 4.0.9, Divi Builder 2.23 – 4.0.9 – PHP Code Injection
The Divi Builder, Divi, and Divi Extra plugin and themes for WordPress are vulnerable to PHP Code Injection in versions up to 4.0.10. This allows authenticated attackers to execute code on a vulnerable site's server that could be…
3.23-4.0.9
4.0.10
04/01/2020
Elegant Themes (Various Versions) – Stored Cross-Site Scripting
The Elegant Themes Divi Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.17.2 in addition to the following themes: Divi
*-3.17.2
3.17.3
30/10/2018
Thèmes également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.