Executive brief
tagDiv Composer is a popular page-building tool used for designing WordPress websites. A security flaw in this tool allows attackers to trick a site administrator or visitor into clicking a malicious link, which then executes unauthorized code in their browser. This could lead to the theft of login sessions, unauthorized website changes, or the redirection of visitors to malicious websites.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the tagDiv Composer (td-composer) WordPress plugin. The flaw stems from the application's failure to properly sanitize or neutralize user-supplied input before including it in generated web pages. An unauthenticated remote attacker can exploit this by crafting a malicious URL and tricking a victim (such as a site administrator) into clicking it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. While NVD lists the affected versions as <= 5.4.3, the primary source (Patchstack) indicates versions up to 5.4.5 are vulnerable.
Affected products
- tagDiv tagDiv Composer (td-composer) <= 5.4.3 (NVD); <= 5.4.5 (Patchstack)
Timeline
- 2026-01-31: other: Vulnerability reported by researcher Bonds
- 2026-07-06: advisory: Initial advisory published by Patchstack
- 2026-07-13: disclosed: CVE published in NVD dataset