VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

tagDiv Composer security & vulnerabilities

td-composer— active installsLast vulnerability Aug 24, 2026

No known unpatched vulnerabilities in the latest version

All 23 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
23Known vulnerabilities
  • Critical2
  • High3
  • Medium18
  • Low0
Vulnerabilities per year
2022: 1 vulnerability1222023: 4 vulnerabilities4232024: 5 vulnerabilities5242025: 7 vulnerabilities7252026: 6 vulnerabilities626

All tagDiv Composer vulnerabilities

tagDiv Composer vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.7Update to 5.4.8
CVE-2026-12561
Medium6.1Reflected Cross-Site Scripting
≤5.4.5Update to 5.4.6
CVE-2026-57734
Medium6.1Reflected Cross-Site Scripting
≤5.4.2Update to 5.4.3
CVE-2025-50001
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤5.4.4Update to 5.4.5
CVE-2026-39712
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.4Update to 5.4.5
CVE-2026-39692
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.2Update to 5.4.3
CVE-2025-50005
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.1Update to 5.4.2
CVE-2025-62030
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.4.1Update to 5.4.2
CVE-2025-62031
Medium6.1Reflected Cross-Site Scripting via 'data'
≤5.3Update to 5.4
CVE-2025-2806
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
≤5.4Update to 5.4.1
CVE-2025-3510
Critical9.8Unauthenticated Arbitrary PHP Object Instantiation
≤5.3Update to 5.4
CVE-2024-13645
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
≤5.3Update to 5.4
CVE-2025-1705
Medium6.1Reflected Cross-Site Scripting via 'account_id' and 'account_username'
≤5.3Update to 5.4
CVE-2025-2804
Medium6.1Reflected Cross-Site Scripting via envato_code[]
≤5.0Update to 5.1
CVE-2024-3886
Medium6.1Reflected Cross-Site Scripting via envato_code[]
≤5.0Update to 5.1
CVE-2024-5212
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode
≤4.8Update to 4.9
CVE-2024-3888
Medium5.5Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta
≤4.8Update to 4.9
CVE-2024-3814
High8.8Authenticated (Contributor+) Local File Inclusion via Shortcode
≤4.8Update to 4.9
CVE-2024-3813
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.1Update to 4.2
CVE-2023-3169
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.1Update to 4.2
CVE-2023-3170
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
<4.4Update to 4.4
CVE-2023-39166
Medium6.1Reflected Cross-Site Scripting via ‘td_video_url’
<4.0Update to 4.0
CVE-2023-1596
Critical9.8Unauthorized Account Access and Privilege Escalation
<3.5Update to 3.5
CVE-2022-3477

tagDiv Composer: common questions

Does tagDiv Composer have known vulnerabilities?

Yes. VulnCrest Radar lists 23 known vulnerabilities in tagDiv Composer: 2 critical, 3 high, 18 medium. None are known to affect version null.

How do I check which version of tagDiv Composer I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent tagDiv Composer vulnerability?

CVE-2026-12561, published Aug 24, 2026: tagDiv Composer <= 5.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any tagDiv Composer vulnerability listed in CISA KEV?

No. None of the known tagDiv Composer vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?