CVE-2026-39725: CWE-94 Improper Control of Generation of Code ('Code Injection') in Jonathan Horowitz Content Visibility for Divi Builder

This vulnerability (CVE-2026-39725) in Content Visibility for Divi Builder versions up to 5.03 is classified as CWE-94: Improper Control of Generation of Code, commonly known as code injection. It allows users with contributor privileges to execute arbitrary code remotely, potentially leading to remote code execution (RCE). The CVSS v3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.

Successful exploitation allows contributor-level users to execute arbitrary code remotely, which can compromise the entire system's confidentiality, integrity, and availability. This could lead to unauthorized access, data manipulation, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and monitor for suspicious activity related to this plugin. Avoid using affected versions if possible.