Vulnerabilities

TI-2025-02450 CVE-2025-2806 · GHSA-rvmm-jpcx-gvp7

tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'

LOW 27

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitiza…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00336 Published 2025-05-08 No fix listed CWE-79

TI-2024-03626 CVE-2024-3886 · GHSA-gg9v-hmq9-q2qr

tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]

LOW 29

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00415 Published 2024-08-31 No fix listed CWE-79

TI-2024-04837 CVE-2024-5212 · GHSA-vh3x-cjp8-qvxc

tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]

LOW 29

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00374 Published 2024-08-31 No fix listed CWE-79

TI-2024-03557 CVE-2024-3813 · GHSA-69pp-qfw7-q7cp

tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode

LOW 39

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00657 Published 2024-06-15 No fix listed CWE-98

TI-2024-03558 CVE-2024-3814 · GHSA-wc5f-w959-5pxw

tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta

LOW 25

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00279 Published 2024-06-15 No fix listed CWE-79

TI-2023-20332 CVE-2023-39166 · GHSA-p58v-p4q5-5r63

WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 31

Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00229 Published 2023-11-13 Fixed in 4.4 CWE-352

TI-2023-02970 CVE-2023-3170 · GHSA-7578-qrmf-q6j6

tagDiv Composer < 4.2 - Admin+ Stored XSS

MEDIUM 55

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform S…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0044 Published 2023-09-11 Fixed in 4.2 CWE-79

TI-2023-02969 CVE-2023-3169 · GHSA-84rx-q376-r85h

tagDiv Composer < 4.2 - Unauthenticated Stored XSS

MEDIUM 60

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters wh…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01217 Published 2023-09-11 Fixed in 4.2

Vulnerabilities

Filters