CVE-2026-1829
published 2026-06-02CVE-2026-1829: The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the…
PriorityP259high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.68%
47.8th percentile
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jhorowitz | content_visibility_for_divi_builder | <= 4.02 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
jhorowitz Content Visibility for Divi Builder Plugin up to 4.02 on WordPress Shortcode et_pb_text cvdb_content_visibility_check code injection
vuldb·2026-06-03·CVSS 8.8
CVE-2026-1829 [HIGH] jhorowitz Content Visibility for Divi Builder Plugin up to 4.02 on WordPress Shortcode et_pb_text cvdb_content_visibility_check code injection
A vulnerability was found in jhorowitz Content Visibility for Divi Builder Plugin up to 4.02 on WordPress. It has been rated as critical. This issue affects the function et_pb_text of the component Shortcode Handler. This manipulation of the argument cvdb_content_visibility_check causes code injection.
This vulnerability appears as CVE-2026-1829. The attack may be initiated remotely. There is no available exploit.
GHSA
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_c
ghsa_unreviewed·2026-06-02
CVE-2026-1829 [HIGH] CWE-94 The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_c
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/content-visibility-for-divi-builder/tags/4.01/includes/plugin.class.php#L229https://plugins.trac.wordpress.org/changeset/3543621/content-visibility-for-divi-builderhttps://www.wordfence.com/threat-intel/vulnerabilities/id/2ea89c44-8ed0-4ab7-a049-4d1b03a898c7?source=cve
2026-06-02
Published