Read the docs

Elegant Themes

Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Elegant Themes records in CISA KEV

No Elegant Themes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Divi 5 records MEDIUM Extra 2 records MEDIUM Bloom 1 record MEDIUM Carousel Maker For Divi 1 record LOW Divi Builder 1 record MEDIUM Monarch 1 record MEDIUM

Records

17 records

TI-2026-61930 CVE-2026-91707 · GHSA-8xr3-mxv3-qm4h

Missing authorization in Elegant Themes Divi

Priority LOW 30

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00453 Published 2026-09-18 No fix listed CWE-862
TI-2024-05243 CVE-2024-5647 · GHSA-3439-fg7p-gc46

Cross-site scripting in BlossomThemes Social Feed

Priority LOW 29

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00366 Published 2025-07-03 No fix listed CWE-79
TI-2024-04177 CVE-2024-4490 · GHSA-2r6r-f3xv-whcp

Cross-site scripting in Elegant Themes Divi Builder

Priority LOW 29

The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ parameter in versions up to, and including, 4.25.0 due to ins…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00505 Published 2024-05-10 No fix listed CWE-79
TI-2026-03339 CVE-2026-3853 · GHSA-qpr5-j4j4-r5pg

Cross-site scripting in Elegant Themes Divi

Priority LOW 28

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00261 Published 2026-09-05 No fix listed CWE-79
TI-2026-03338 CVE-2026-3852 · GHSA-wxj5-fwg9-6vxf

Cross-site scripting in Elegant Themes Divi

Priority LOW 28

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00261 Published 2026-09-03 No fix listed CWE-79
TI-2026-03337 CVE-2026-3851 · GHSA-rp2j-7c4f-r683

Cross-site scripting in Elegant Themes Divi

Priority LOW 28

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00283 Published 2026-09-02 No fix listed CWE-79
TI-2026-03336 CVE-2026-3850 · GHSA-q2q3-cp6p-r7mv

Cross-site scripting in Elegant Themes Divi

Priority LOW 28

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, and including, 4.27.6.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00261 Published 2026-09-02 No fix listed CWE-79
TI-2025-00284 CVE-2025-0350 · GHSA-6vjp-j762-h2vc

Cross-site scripting in badhonrocks Divi Carousel Free

Priority LOW 28

The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and incl…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0036 Published 2025-01-25 No fix listed CWE-79
TI-2024-05144 CVE-2024-5533 · GHSA-v437-gvmx-8wm3

Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00282 Published 2024-06-18 No fix listed CWE-20
TI-2023-06163 CVE-2023-6744 · GHSA-w664-qg6x-7hwx

Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00348 Published 2023-12-23 No fix listed CWE-79
Open these records in search →