Vulnerability found in js library used by Divi

Hey deimian,

The latest version of Divi still seems to be using v1.4.5. In theory you could replace the library in the location found in your grep results, but there's a chance changes in the library will cause some parts of the site to stop working correctly. If you decide to update, it looks like Divi enqueues this script if any of the following modules are used, so I'd test their functionality after updating:

Portfolio
Slider
Post Slider
Fullwidth Slider
Fullwidth Post Slider
Video Slider

Also note that replacing the file directly in Divi's theme folder would mean that it will be overwritten if you update Divi. Otherwise, you'd probably need to use PHP code to dequeue the affected version and enqueue the updated version.

But I'd suggest contacting Elegant Themes about it:

https://www.elegantthemes.com/contact/

They may be able to provide a workaround until a fix is available. They may also be able to tell you whether there is actually an issue - not all vulnerabilities in JavaScript libraries translate into vulnerabilities in the product using them (since they may not use the affected functionality from the library, for example).