CVE-2026-1829 PUBLISHED

Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution

Assigner: Wordfence
Reserved: 03.02.2026 Published: 02.06.2026 Updated: 03.06.2026

The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor jhorowitz
Product Content Visibility for Divi Builder
Versions Default: unaffected
  • affected from 0 to 4.02 (incl.)

Credits

  • ZAST.AI finder

References

Problem Types

  • CWE-94 Improper Control of Generation of Code ('Code Injection') CWE