---
title: "Divi"
description: "Divi by Elegant Themes: strengths, limitations, pricing, the move to Divi 5, recommended settings and patched vulnerabilities, to decide and set it up."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/divi/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:04:58+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/divi/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/divi/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/divi/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/divi/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/divi/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/divi/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/divi/index.md"
---

# Divi

Divi, the theme and visual builder from Elegant Themes, has no free version but covers unlimited sites. Our take on its strengths, its limits, the move from Divi 4 to Divi 5, the settings to change and the vulnerabilities worth knowing.

## The essentials

- Best for agencies and freelancers who build lots of sites visually, without writing code.
- Main caveat: your pages depend on Divi, and switching away means rebuilding them.
- Paid only: $89 per year or $249 for life, on unlimited sites, with no free version.

## What Divi does on your site

Divi is both a WordPress theme and a visual page builder, made by Elegant Themes. You build each page live, on the site itself, with sections, rows and modules (text, image, contact form, slider, WooCommerce shop...), and the Theme Builder applies the same approach to headers, footers and post or archive templates.

The same engine ships in three forms: the Divi theme, the Extra magazine theme and the Divi Builder plugin, which brings the builder to any other theme. Since February 26, 2026, two branches have run side by side: Divi 4, which now only gets security patches and critical bug fixes, and Divi 5, where all new features land. In Divi 4, layouts are stored in your content as shortcodes; the Divi 5 Migrator converts them to the new Divi 5 format.

Divi is not distributed on wordpress.org. A membership covers Divi, Extra, Divi Builder, Bloom and Monarch on unlimited sites, and updates come through the WordPress dashboard once your Elegant Themes account is connected to the site.

![Diagram: Divi works on visitors and bots, wordpress, database and files. Public traces: generator tag (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/divi/diagram-en.svg?v=a1f82e95)

## Which sites Divi is a good fit for

Divi makes the most sense when cost per site and visual editing matter more than a lean setup:

- **Agencies and freelancers who ship lots of sites**: one membership covers every site, and the Role Editor lets you hand a site to a client without giving them the layout controls.
- **Business sites and small stores built without code**: WooCommerce modules, the Theme Builder and premade layouts save you from stitching several plugins together.
- **Teams that would rather pay once**: Divi Lifetime includes lifetime updates and support for a single payment.

It is the wrong pick if you want to be able to switch themes without rebuilding your pages, or for a mostly text blog where the block editor is enough. If you are weighing it against another builder, compare it with [Elementor](https://www.wp-masquerade.com/features/camouflaged-plugins/elementor/) or read our [WordPress page builder comparison](https://www.wp-masquerade.com/best-wordpress-page-builders-compared/).

## Divi strengths and limitations

### Strengths

- **Unlimited sites for one price.** Both the yearly plan and the lifetime plan cover as many sites as you like.
- **The whole site in one tool.** Pages, headers, footers, archive templates and WooCommerce pages are all built in the same visual editor.
- **Fine-grained permissions.** The Role Editor sets, role by role, access to the builder, modules, the library, Theme Options and import/export.
- **Built-in optimizations.** Dynamic CSS, critical CSS, on-demand icons and jQuery deferral are on by default, with no extra plugin.

### Limitations

- **No free version.** You have to buy it to try it, with a refund available within 30 days.
- **Pages tied to Divi.** Your content depends on Divi’s format (shortcodes in Divi 4), so leaving Divi means rebuilding your pages.
- **Patches for active members only.** If you don’t renew, Divi keeps working but gets no more updates, security fixes included.
- **A Divi 4 to Divi 5 transition to manage.** Migration is one-way, and third-party modules that are not yet compatible run in backward compatibility mode, without the performance gains.
- **AI and cloud storage cost extra.** Divi AI, Divi Cloud and Divi VIP are separate subscriptions, bundled in Divi Pro.

## The Divi settings we recommend

These settings exist in Divi 5 and, for the most part, in Divi 4, under Divi > Theme Options.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Username and API Key**  Divi > Theme Options > Updates | Filled in, one key per client site | Without them, WordPress offers no new Divi versions; a key per client can be deactivated when the contract ends. |
| **Contributor and Author permissions**  Divi > Role Editor | Portability, library, global modules and Theme Options turned off | Most known Divi vulnerabilities require a contributor account: the fewer tools that role has, the fewer ways in. |
| **Performance tab**  Divi > Theme Options > General > Performance | Defaults | Elegant Themes advises keeping them unless you see display issues; test a page after every change. |
| **Force Enable D4 Shortcode Framework**  Divi > Theme Options > Builder > Advanced | Off (Divi 5) | Elegant Themes reserves it for third-party plugins that depend on the Divi 4 engine; elsewhere it just loads legacy code. |
| **SEO tab**  Divi > Theme Options > SEO | Off if you use an SEO plugin | Two sources of titles, descriptions and canonical URLs produce duplicate tags. |
| **Enable Divi 5 Updates**  Divi > Dashboard | Only after a successful test copy | Moving to Divi 5 runs through the Migrator and gets hard to undo once content has been edited. |

- In Dashboard > Updates, click “Check again”: the latest Divi version should appear or already be installed.
- Log in with a test contributor account and check that the Role Editor restrictions apply.
- Before enabling Divi 5, run the Migrator compatibility scan on a [staging copy](https://www.wp-masquerade.com/glossary/staging-environment/) and note the modules flagged in orange.

## Divi security: mostly contributor-level XSS

Because Divi, Extra and Divi Builder share the same builder, one flaw often hits all three. Most published vulnerabilities are [stored XSS](https://www.wp-masquerade.com/glossary/xss/): a contributor account slips JavaScript into a module setting, and the script runs for visitors, administrators included. The cases worth knowing:

- **CVE-2020-35945, fixed in 4.5.3**: the file extension check on imports only ran in the browser, so a contributor could upload a PHP file to the server.
- **CVE-2024-4490, versions up to 4.25.0**: DOM-based stored XSS through the title parameter, in Divi, Extra and Divi Builder.
- **CVE-2026-3850 and CVE-2026-4361, fixed in 4.27.7**: an XSS through the contact form redirect URL and an SSRF through video thumbnails, both open to a contributor.
- **CVE-2026-13712, fixed in 5.9.0**: stored XSS through the Skype link of the Divi 5 social media follow module.
- **CVE-2026-91707, versions up to 5.11.1**: a REST API endpoint of the Shortcode module let a visitor with no account run the shortcodes registered on the site.

Keep your license active, install the latest version of your branch and hand out the contributor role sparingly. The full timeline is in our article on the [history of Divi theme vulnerabilities](https://www.wp-masquerade.com/divi-theme-security-vulnerabilities/). With WP Masquerade Pro, the theme folder address, its file IDs and its cache folder are hidden, but the `et_pb_*` classes stay visible in the HTML: that slows bots down, it is not a patch.

## Frequently asked questions about Divi

**Is there a free version of Divi?**

No. Divi is sold as a yearly membership or a one-time payment, and Elegant Themes offers a full refund, no questions asked, within 30 days.

**What happens if I don’t renew my membership?**

Your account stays active until the end of the paid year. After that, you can keep using the themes you already downloaded, but you lose updates, security patches included, and support.

**Should I move from Divi 4 to Divi 5 now?**

For a new site, start directly on Divi 5. For an existing site, Elegant Themes commits to supporting Divi 4 for at least 12 months after February 26, 2026: back up, test the migration on a copy and check that your third-party modules are compatible before you switch.

**What is the difference between the Divi theme and the Divi Builder plugin?**

The builder is the same. The Divi theme also handles the site’s overall look, while the Divi Builder plugin adds the builder to another theme; both are included in the membership.

## Key facts

- Category: Builders and themes
- Vendor: Elegant Themes
- Price: $89 per year, or $249 one-time (Divi Lifetime), unlimited sites
- Official page: https://www.elegantthemes.com/gallery/divi/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: generator tag, folder name, tag IDs, generated-file folders
- Still visible: JavaScript variables, CSS classes