Elegantthemes develops a focused portfolio of WordPress page-builder and design plugins, with its flagship Divi builder and related products such as Extra, Bloom, and Carousel Maker representing the vendor's primary footprint. The durable signal in its vulnerability history centers on web-application input-handling and access-control weaknesses, including cross-site scripting, improper privilege management, unrestricted file uploads, and input-validation flaws that are characteristic of WordPress plugin development. Defenders tracking this vendor should monitor its plugin releases and ensure timely updates, particularly for internet-accessible WordPress installations; current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Elegantthemes over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-1579MEDIUM Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revsli | Feb 11, 2015 | 5.0 | 40 | NO | YES |
CVE-2020-35945HIGH An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabiliti | Jan 1, 2021 | 8.8 | 27 | NO | NO |
CVE-2016-11004HIGH The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. | Sep 20, 2019 | 8.8 | 25 | NO | NO |
CVE-2016-11003HIGH The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. | Sep 20, 2019 | 8.8 | 25 | NO | NO |
CVE-2016-11002HIGH The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. | Sep 20, 2019 | 8.8 | 25 | NO | NO |
CVE-2025-0350MEDIUM The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo | Jan 25, 2025 | 5.4 | 18 | NO | NO |
CVE-2023-6744MEDIUM The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1 due to insufficient i | Dec 23, 2023 | 5.4 | 18 | NO | NO |
CVE-2023-29099MEDIUM Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Elegant themes Divi theme <= 4.20.2 versions. | Aug 8, 2023 | 5.4 | 18 | NO | NO |
CVE-2024-5533MEDIUM The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization and output escaping. T | Jun 18, 2024 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Elegantthemes.
Media articles that mention a CVE ID that affects a product developed by Elegantthemes — matched by CVE ID, not by vendor name.