Executive brief
tagDiv Composer is a popular page-building tool for WordPress websites. A security flaw allows an attacker with basic contributor-level access to inject malicious scripts into the site's content. If a site administrator or visitor views the affected page, these scripts could redirect users to malicious websites, display unauthorized advertisements, or potentially compromise user sessions.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the tagDiv Composer (td-composer) WordPress plugin due to improper neutralization of user-supplied input during web page generation. An attacker with 'Contributor' or higher privileges can inject malicious JavaScript payloads into the database. These scripts are subsequently executed in the browser of any user (including administrators) who views the affected content. The vulnerability is assigned CWE-79 and was addressed in version 5.4.5. Exploitation requires minimal user interaction (viewing the page) and has a CVSS score of 6.5.
Affected products
- tagDiv tagDiv Composer (td-composer) <= 5.4.4
Timeline
- 2026-01-25: other: Vulnerability reported by researcher João Pedro S Alcântara (Kinorth)
- 2026-02-24: disclosed: Initial disclosure by Patchstack
- 2026-02-24: patched: Version 5.4.5 released to address the issue
- 2026-04-08: advisory: CVE published to NVD