SecAlerts
e

elegant themes

Security Risk Profile

44
/100
medium

Security Risk Score

Comprehensive risk assessment based on 11 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from February 11, 2015 to present

11
Total CVEs
2
Critical+High
0
Exploited
2
Unpatched

Threat Assessment

Avg CVSS
7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
2
Critical/High
Risk Level
44/100
medium
🆕 1Fresh (<7d)📈 4 in Last 30 Days

Severity Distribution

Critical
2
High
0
Medium
8
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
XSS
7
2
Malicious File Upload
2
3
Path Traversal
1

Most Affected Products

1. Elegant Themes Divi3
2. Elegant Themes Divi Wordpress3
3. Elegantthemes Divi Wordpress3
4. Elegant Themes Divi Theme2
5. Elegant Themes Extra Theme2

Recent Vulnerabilities

See more →
CVE-2026-14321
unknown

Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

Sep 23, 2026🔧 No Patch
CVE-2026-3853
CVSS 6.4medium

Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

Sep 5, 2026🔧 No Patch
CVE-2026-3852
CVSS 6.4medium

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

Sep 3, 2026🔧 No Patch
CVE-2026-3851
CVSS 6.4medium

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

Sep 2, 2026🔧 No Patch
CVE-2026-5524
CVSS 9.8critical

Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

Jul 2, 2026🔧 No Patch
CVE-2025-0350
CVSS 6.4medium

Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets

Jan 25, 2025
CVE-2024-5892
CVSS 6.4EPSS 0%medium

Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

Jun 12, 2024🔧 No Patch
CVE-2024-4490
CVSS 6.4EPSS 0%medium

Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

May 10, 2024🔧 No Patch
CVE-2023-29099
CVSS 6.5medium

WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS)

Aug 8, 2023
CVE-2020-35945
CVSS 9.9critical
Jan 1, 2021🔧 No Patch

Monitor elegant themes in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

elegant themes Security Vulnerabilities & Risk Score | 11 CVEs | SecAlerts - SecAlerts