Vendor
2 published CVES affecting DiviEngine, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmem_form_submit_handler() function determining the new user's role by iterating all WordPress roles and calling password_verify() against an...
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The process_paypal_callback function, hooked to the init action, accepts a base64-encoded paypal_param GET parameter with no IPN validation, no cryptograph...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.