Td Composer Vulnerabilities

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc_raw_html::render() method, which base64-decodes shortcode content (after a strip_tag...

CVSS:

6.4

Affected:

up to 5.4.5

Fix:

No patched version reported

Disclosed:

Aug 24, 2026

CVE-2026-12561 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 5.4.5

Fixed in:

5.4.6

Disclosed:

Jul 6, 2026

CVE-2026-57734 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 5.4.2

Fixed in:

5.4.3

Disclosed:

Mar 10, 2026

CVE-2025-50001 on NVD →

The The tagDiv Composer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attacke...

CVSS:

6.5

Affected:

up to 5.4.4

Fixed in:

5.4.5

Disclosed:

Mar 2, 2026

CVE-2026-39712 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 5.4.4

Fixed in:

5.4.5

Disclosed:

Feb 24, 2026

CVE-2026-39692 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.

Affected:

up to 5.4.2

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-50005 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 5.4.2

Fixed in:

5.4.3

Disclosed:

Jan 8, 2026

CVE-2025-50005 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.

Affected:

up to 5.4.1

Fix:

No patched version reported

Disclosed:

Nov 6, 2025

CVE-2025-62031 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.

Affected:

up to 5.4.1

Fix:

No patched version reported

Disclosed:

Nov 6, 2025

CVE-2025-62030 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 5.4.1

Fixed in:

5.4.2

Disclosed:

Oct 16, 2025

CVE-2025-62030 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user access...

CVSS:

7.2

Affected:

up to 5.4.1

Fixed in:

5.4.2

Disclosed:

Oct 9, 2025

CVE-2025-62031 on NVD →

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVSS:

6.1

Affected:

up to 5.3

Fixed in:

5.4

Disclosed:

May 7, 2025

CVE-2025-2806 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acces...

CVSS:

6.4

Affected:

up to 5.4

Fixed in:

5.4.1

Disclosed:

May 1, 2025

CVE-2025-3510 on NVD →

[en] The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerabili...

Affected:

up to 5.4

Fixed in:

5.4

Disclosed:

Apr 4, 2025

CVE-2024-13645 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability ha...

CVSS:

9.8

Affected:

up to 5.3

Fixed in:

5.4

Disclosed:

Apr 3, 2025

CVE-2024-13645 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged...

CVSS:

6.1

Affected:

up to 5.3

Fixed in:

5.4

Disclosed:

Mar 27, 2025

CVE-2025-1705 on NVD →

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated a...

CVSS:

6.1

Affected:

up to 5.3

Fixed in:

5.4

Disclosed:

Mar 27, 2025

CVE-2025-2804 on NVD →

[en] The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This makes it possible for unauthenticated a...

Affected:

up to 5.1

Fixed in:

5.1

Disclosed:

Aug 31, 2024

CVE-2024-3886 on NVD →

[en] The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated...

Affected:

up to 5.1

Fixed in:

5.1

Disclosed:

Aug 31, 2024

CVE-2024-5212 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This makes it possible for unauthenticated attack...

CVSS:

6.1

Affected:

up to 5.0

Fixed in:

5.1

Disclosed:

Aug 30, 2024

CVE-2024-3886 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated atta...

CVSS:

6.1

Affected:

up to 5.0

Fixed in:

5.1

Disclosed:

Aug 30, 2024

CVE-2024-5212 on NVD →

[en] The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-le...

Affected:

up to 4.9

Fixed in:

4.9

Disclosed:

Jun 15, 2024

CVE-2024-3814 on NVD →

[en] The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitra...

Affected:

up to 4.9

Fixed in:

4.9

Disclosed:

Jun 15, 2024

CVE-2024-3813 on NVD →

[en] The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu...

Affected:

up to 4.9

Fixed in:

4.9

Disclosed:

Jun 4, 2024

CVE-2024-3888 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l...

CVSS:

6.4

Affected:

up to 4.8

Fixed in:

4.9

Disclosed:

Jun 3, 2024

CVE-2024-3888 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary fi...

CVSS:

8.8

Affected:

up to 4.8

Fixed in:

4.9

Disclosed:

Apr 18, 2024

CVE-2024-3813 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level a...

CVSS:

5.5

Affected:

up to 4.8

Fixed in:

4.9

Disclosed:

Apr 18, 2024

CVE-2024-3814 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.

Affected:

up to 4.4

Fixed in:

4.4

Disclosed:

Nov 13, 2023

CVE-2023-39166 on NVD →

[en] The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for...

Affected:

up to 4.2

Fixed in:

4.2

Disclosed:

Sep 11, 2023

CVE-2023-3170 on NVD →

[en] The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site S...

Affected:

up to 4.2

Fixed in:

4.2

Disclosed:

Sep 11, 2023

CVE-2023-3169 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings set through a REST route in versions up to, and including, 4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

7.2

Affected:

up to 4.1

Fixed in:

4.2

Disclosed:

Aug 17, 2023

CVE-2023-3169 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitra...

CVSS:

4.4

Affected:

up to 4.1

Fixed in:

4.2

Disclosed:

Aug 17, 2023

CVE-2023-3170 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, but not including, 4.4. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to inject malicious web scripts into pages via a forged reques...

CVSS:

6.1

Affected:

up to 4.4

Fixed in:

4.4

Disclosed:

Jul 25, 2023

CVE-2023-39166 on NVD →

[en] The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected:

up to 4.0

Fixed in:

4.0

Disclosed:

May 15, 2023

CVE-2023-1596 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘td_video_url’ parameter in versions up to, but not including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVSS:

6.1

Affected:

up to 4.0

Fixed in:

4.0

Disclosed:

Apr 17, 2023

CVE-2023-1596 on NVD →

[en] The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Affected:

up to 3.5

Fixed in:

3.5

Disclosed:

Nov 14, 2022

CVE-2022-3477 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, but not including, 3.5 due to improper implementation of the Facebook login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email addres...

CVSS:

9.8

Affected:

up to 3.5

Fixed in:

3.5

Disclosed:

Oct 24, 2022

CVE-2022-3477 on NVD →

Affected:

up to 5.4

Fixed in:

5.4

CVE-2025-2806 on NVD →

Affected:

up to 5.4.1

Fixed in:

5.4.1

CVE-2025-3510 on NVD →

Affected:

up to 5.4

Fixed in:

5.4

CVE-2025-2804 on NVD →

Affected:

up to 5.4

Fixed in:

5.4

CVE-2025-1705 on NVD →