Schwachstellen verstehen. Anwendungen schützen.

Hoch 09.10.2026

CVE-2026-91136

Divi Plus <= 2.4.0 – Nicht authentifiziertes Auslesen beliebiger Dateien über den Parameter 'svg_image'

Das WordPress-Plugin Divi Plus ermöglicht unauthentifizierten Angreifern das Auslesen beliebiger Dateien vom Server über eine fehlerhafte Eingabevalidierung in einem REST-Endpunkt.

WordPress

divi-plus

Hoch 05.10.2026

CVE-2026-39725

Content Visibility for Divi Builder <= 5.03 - Authenticated (Contributor+) Remote Code Execution

WordPress

content-visibility-for-divi-builder

Kritisch 01.10.2026

CVE-2026-19660

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

WordPress

divi-membership

Kritisch 01.10.2026

CVE-2026-19652

Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

WordPress

divi-membership

Mittel 30.09.2026

CVE-2026-102384

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.63 - Authenticated (Author+) Stored Cross-Site Scripting

WordPress

supreme-modules-for-divi

Mittel 21.09.2026

CVE-2026-14321

Divi Dash <= 1.0.6 - Unauthenticated IP Spoofing to Protection Bypass

WordPress

divi-dash

Mittel 18.09.2026

CVE-2026-15760

Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

WordPress

divi-essential

Hoch 18.09.2026

CVE-2026-87909

WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

WordPress

wp-photo-album-plus

Mittel 17.09.2026

CVE-2026-91707

Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

WordPress

divi

Mittel 04.09.2026

CVE-2026-3853

Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

WordPress

divi

Mittel 04.09.2026

CVE-2026-4361

Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

WordPress

divi

Kritisch 03.09.2026

CVE-2026-11613

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

WordPress

divi-ajax-filter

Mittel 02.09.2026

CVE-2026-3852

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

WordPress

divi

Mittel 01.09.2026

CVE-2026-3850

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

WordPress

divi

Mittel 01.09.2026

CVE-2026-3851

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

WordPress

divi

Mittel 30.08.2026

CVE-2026-14835

SOGO Add Script to Individual Pages Header Footer <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

oh-add-script-header-footer

Mittel 15.08.2026

CVE-2026-13358

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

WordPress

simply-schedule-appointments

Mittel 14.08.2026

CVE-2026-13712

Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

divi

Hoch 04.08.2026

7bbead7c-47b9-473f-b335-6fae4b5998d6

Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

WordPress

contact-form-extender-for-divi-builder

Mittel 31.07.2026

CVE-2026-17580

Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

WordPress

acf-views

Hoch 23.07.2026

CVE-2026-10033

EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

WordPress

eventon-action-user

Mittel 22.07.2026

CVE-2026-59543

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution

WordPress

acf-views

Mittel 10.07.2026

CVE-2026-3367

Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting

WordPress

lockme-calendars-integration

Hoch 08.07.2026

CVE-2026-4275

Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint

WordPress

addons-for-divi