Divi Engine vulnerabilities
We track 4 vulnerabilities in Divi Engine products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
Latest Divi Engine vulnerabilities
- 9.8 Critical severity
Divi Ajax Filter: Improper Control of Filename for Include/Require Statement in PHP Program
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrar
- 8.8 High severity
Divi Form Builder: Authorization Bypass Through User-Controlled Key
The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated us
- 9.8 Critical severity
Divi Form Builder: Unrestricted Upload of File with Dangerous Type
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-sup
- 9.8 Critical severity
Divi Form Builder: Improper Privilege Management
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it again