# CVE-2026-39712: tagDiv Composer content injection in td-composer

Source: https://junglewise.ai/threats/cve-2026-39712-tagdiv-composer-content-injection-in-td-composer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39712 · Severity: medium · CVSS 5.3 · Published 2026-04-08

tagDiv Composer is a popular page builder plugin for WordPress websites. A vulnerability in this plugin allows unauthorized individuals to inject malicious code or content into a website's pages. This could lead to the creation of phishing pages, unauthorized content modification, or the redirection of visitors to malicious sites, potentially damaging the site's reputation and user trust.

Technologies: [tagDiv Composer](https://junglewise.ai/threats/technologies/tagdiv-composer). Vendors: [tagDiv](https://junglewise.ai/threats/vendors/tagdiv).

## Quick answers

**Is CVE-2026-39712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39712 being exploited in the wild.

**How severe is CVE-2026-39712?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** tagDiv Composer <= 5.4.4.

**Is there a fix for CVE-2026-39712?** A patch was published on 2026-03-02: Patch released in version 5.4.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39712 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39712?** Check whether you run tagDiv Composer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the tagDiv Composer (td-composer) plugin for WordPress through version 5.4.4 due to improper neutralization of script-related HTML tags. This flaw allows an unauthenticated remote attacker to perform content injection and arbitrary shortcode execution. By sending a specially crafted request, an attacker can inject malicious scripts or content into the web pages served by the plugin. The issue is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). A patch is available in version 5.4.5.

## Affected products

- tagDiv tagDiv Composer <= 5.4.4

## Timeline

- 2026-01-31: other: Vulnerability reported by researcher Bonds
- 2026-03-02: disclosed: Initial disclosure by Patchstack
- 2026-03-02: patched: Patch released in version 5.4.5
- 2026-04-08: advisory: CVE published to NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-3-arbitrary-shortcode-execution-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-3-arbitrary-shortcode-execution-vulnerability?_s_id=cve)

## Related threats

- [tagDiv Composer Reflected XSS in td-composer](https://junglewise.ai/threats/cve-2026-57734-tagdiv-composer-reflected-xss-in-td-composer)
- [tagDiv Composer Stored XSS in WordPress Plugin](https://junglewise.ai/threats/cve-2026-39692-tagdiv-composer-stored-xss-in-wordpress-plugin)