Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:badhonrocks:divi_torque_lite_–_divi_theme,_divi_builder_&_extra_theme:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorBadhonrocks (736a4bff-6ee4-5311-995c-b91bc2da8686)
ProductDivi Torque Lite – Divi Theme, Divi Builder & Extra Theme (8e0cb53d-a8e6-5f52-b52d-17ce73da5881)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-0353 vulnerable 2026-06-08 07:02:24.429536 Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
MEDIUM (6.4)
The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-01-29T11:10:03.278Z
Updated: 2026-04-08T17:26:09.410Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-5892 vulnerable 2026-06-08 06:56:17.699420 Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
MEDIUM (6.4)
The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘support_unfiltered_files_upload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-06-12T05:34:02.862Z
Updated: 2026-04-08T17:02:00.176Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-5647 vulnerable 2026-06-08 06:56:16.861695 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
MEDIUM (6.4)
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Published: 2025-07-03T09:22:19.308Z
Updated: 2026-08-25T19:06:26.772Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-4974 vulnerable 2026-06-08 05:52:02.758025 Freemius SDK <= 2.4.2 - Missing Authorization Checks
MEDIUM (6.3)
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Published: 2024-10-16T06:43:30.014Z
Updated: 2026-04-08T16:46:54.861Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.