Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 90

Reset filters

High 09.10.2026

CVE-2026-91136

Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

An arbitrary file read vulnerability in the Divi Plus WordPress plugin allows unauthenticated attackers to view sensitive files on the server via an insecure REST endpoint.

High 05.10.2026

CVE-2026-39725

Content Visibility for Divi Builder <= 5.03 - Authenticated (Contributor+) Remote Code Execution

Critical 01.10.2026

CVE-2026-19660

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

Critical 01.10.2026

CVE-2026-19652

Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

Medium 30.09.2026

CVE-2026-102384

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.63 - Authenticated (Author+) Stored Cross-Site Scripting

Medium 21.09.2026

CVE-2026-14321

Divi Dash <= 1.0.6 - Unauthenticated IP Spoofing to Protection Bypass

Medium 18.09.2026

CVE-2026-15760

Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

High 18.09.2026

CVE-2026-87909

WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

Medium 17.09.2026

CVE-2026-91707

Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

Medium 04.09.2026

CVE-2026-3853

Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

Medium 04.09.2026

CVE-2026-4361

Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

Critical 03.09.2026

CVE-2026-11613

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

Medium 02.09.2026

CVE-2026-3852

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

Medium 01.09.2026

CVE-2026-3850

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

Medium 01.09.2026

CVE-2026-3851

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

Medium 30.08.2026

CVE-2026-14835

SOGO Add Script to Individual Pages Header Footer <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium 15.08.2026

CVE-2026-13358

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

Medium 14.08.2026

CVE-2026-13712

Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

High 04.08.2026

7bbead7c-47b9-473f-b335-6fae4b5998d6

Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

Medium 31.07.2026

CVE-2026-17580

Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

High 23.07.2026

CVE-2026-10033

EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

Medium 22.07.2026

CVE-2026-59543

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution

Medium 10.07.2026

CVE-2026-3367

Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting

High 08.07.2026

CVE-2026-4275

Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint

Showing 1 to 24 of 90 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 90

Know which vulnerabilities affect your application

Application security in your inbox