Read the docs

Divi Essential

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Divi Essential records in CISA KEV

No Divi Essential vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-70167 CVE-2026-91136 · GHSA-9676-xmxf-xp84

Divi Plus Unauthenticated Arbitrary File Read via svg_image Parameter

Priority MEDIUM 44

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02859 Published 2026-10-10 No fix listed CWE-22
TI-2026-13259 CVE-2026-15760 · GHSA-hcxp-7h6p-263r

Missing authorization in Divi Essentials

Priority LOW 29

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00375 Published 2026-09-19 No fix listed CWE-862
Open these records in search →