Divi Plus vulnerabilities

1 known vulnerability in Divi Plus from Divi Essential. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Divi Plus: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-91136Oct 10, 2026Divi EssentialEPSS 2.86%

  The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (