Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for Divi Plus by Divi Essential
CVE-2026-91136 (GCVE-0-2026-91136)
Vulnerability from nvd – Published: 2026-10-10 08:26 – Updated: 2026-10-10 08:26
VLAI
EPSS
VEX
Title
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Summary
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.5 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Divi Essential | Divi Plus |
Affected:
0 , ≤ 2.4.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Divi Plus",
"vendor": "Divi Essential",
"versions": [
{
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ShinThink"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the \u0027svg_image\u0027 parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint\u0027s permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the \u0027svg_image\u0027 input \u2014 sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs \u2014 before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON \u0027html\u0027 field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:38.959Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0bbdf6-afaf-4194-ada2-24d142892c32?source=cve"
},
{
"url": "https://diviplus.io/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T19:29:57.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:42:56.000Z",
"value": "Disclosed"
}
],
"title": "Divi Plus \u003c= 2.4.0 - Unauthenticated Arbitrary File Read via \u0027svg_image\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91136",
"datePublished": "2026-10-10T08:26:38.959Z",
"dateReserved": "2026-09-14T19:44:56.205Z",
"dateUpdated": "2026-10-10T08:26:38.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91136 (GCVE-0-2026-91136)
Vulnerability from cvelistv5 – Published: 2026-10-10 08:26 – Updated: 2026-10-10 08:26
VLAI
EPSS
VEX
Title
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Summary
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.5 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Divi Essential | Divi Plus |
Affected:
0 , ≤ 2.4.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Divi Plus",
"vendor": "Divi Essential",
"versions": [
{
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ShinThink"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the \u0027svg_image\u0027 parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint\u0027s permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the \u0027svg_image\u0027 input \u2014 sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs \u2014 before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON \u0027html\u0027 field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:38.959Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0bbdf6-afaf-4194-ada2-24d142892c32?source=cve"
},
{
"url": "https://diviplus.io/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T19:29:57.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:42:56.000Z",
"value": "Disclosed"
}
],
"title": "Divi Plus \u003c= 2.4.0 - Unauthenticated Arbitrary File Read via \u0027svg_image\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91136",
"datePublished": "2026-10-10T08:26:38.959Z",
"dateReserved": "2026-09-14T19:44:56.205Z",
"dateUpdated": "2026-10-10T08:26:38.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}