plugin

Divi Plus Vulnerabilities

1 known security issue reported for the Divi Plus WordPress plugin. Most recent disclosed Oct 9, 2026.

1 high

Running Divi Plus on your site? Check whether your installed version is affected.

Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

high

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unco...

CVSS:: 7.5
Affected:: up to 2.4.0
Fixed in:: 2.4.1
Disclosed:: Oct 9, 2026

CVE-2026-91136 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database