CVE-2024-4490: The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’…

PriorityP430medium6.4CVSS 3.1

AVNACLPRLUINSCCLILAN

EPSS

0.51%

39.3th percentile

The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ parameter in versions up to, and including, 4.25.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
elegant_themes	divi	<= 4.25.0	—
elegant_themes	divi_builder	<= 4.25.0	—
elegant_themes	divi_extra	<= 4.25.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.