Skip to content

Tagdiv Composer vulnerabilities

tagdiv composertagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-125616.4 MediumAugust 25, 2026
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-577347.1 HighJuly 13, 2026
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerabilityCVE-2026-397125.3 MediumApril 8, 2026
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-396926.5 MediumApril 8, 2026
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2025-500017.1 HighMarch 19, 2026
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-500056.5 MediumJanuary 22, 2026
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-620317.1 HighNovember 6, 2025
tagdiv composerWordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-620306.5 MediumNovember 6, 2025
tagdiv composertagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'CVE-2025-28066.1 MediumMay 8, 2025
tagdiv composertagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesCVE-2025-35106.4 MediumMay 2, 2025
tagdiv composerTagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object InstantiationCVE-2024-136459.8 CriticalApril 4, 2025
tagdiv composertagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2025-17056.1 MediumMarch 28, 2025
tagdiv composertagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'CVE-2025-28046.1 MediumMarch 28, 2025
tagdiv composertagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]CVE-2024-52126.1 MediumAugust 31, 2024
tagdiv composertagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]CVE-2024-38866.1 MediumAugust 31, 2024
tagdiv composertagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via ShortcodeCVE-2024-38138.8 HighJune 15, 2024
tagdiv composertagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetaCVE-2024-38145.5 MediumJune 15, 2024
tagdiv composertagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button ShortcodeCVE-2024-38886.4 MediumJune 4, 2024
tagdiv composerWordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-391667.1 HighNovember 13, 2023
tagdiv composer, unknown tagdiv composer +1 moretagDiv Composer < 4.2 - Admin+ Stored XSSCVE-2023-31704.8 MediumSeptember 11, 2023
tagdiv composer, unknown tagdiv composer +1 moretagDiv Composer < 4.2 - Unauthenticated Stored XSSCVE-2023-31696.1 MediumSeptember 11, 2023
tagdiv composer, unknown tagdiv composer +1 moretagDiv Composer < 4.0 - Reflected Cross-site ScriptingCVE-2023-15966.1 MediumMay 15, 2023
macho themes newsmag, newspaper project newspaper, tagdiv composer +2 moretagDiv Composer < 3.5 - Unauthenticated Account TakeoverCVE-2022-34779.8 CriticalNovember 14, 2022